// Code generated for package vfs by go-bindata DO NOT EDIT. (@generated)
// sources:
// charts/base/Chart.yaml
// charts/base/files/crd-all.gen.yaml
// charts/base/files/crd-mixer.yaml
// charts/base/kustomization.yaml
// charts/base/templates/clusterrole.yaml
// charts/base/templates/clusterrolebinding.yaml
// charts/base/templates/crds.yaml
// charts/base/templates/endpoints.yaml
// charts/base/templates/namespaces.yaml
// charts/base/templates/serviceaccount.yaml
// charts/base/templates/services.yaml
// charts/base/values.yaml
// charts/gateways/istio-egress/Chart.yaml
// charts/gateways/istio-egress/NOTES.txt
// charts/gateways/istio-egress/templates/_affinity.tpl
// charts/gateways/istio-egress/templates/_helpers.tpl
// charts/gateways/istio-egress/templates/autoscale.yaml
// charts/gateways/istio-egress/templates/deployment.yaml
// charts/gateways/istio-egress/templates/poddisruptionbudget.yaml
// charts/gateways/istio-egress/templates/preconfigured.yaml
// charts/gateways/istio-egress/templates/service.yaml
// charts/gateways/istio-egress/templates/serviceaccount.yaml
// charts/gateways/istio-egress/values.yaml
// charts/gateways/istio-ingress/Chart.yaml
// charts/gateways/istio-ingress/NOTES.txt
// charts/gateways/istio-ingress/templates/_affinity.tpl
// charts/gateways/istio-ingress/templates/addongateway.yaml
// charts/gateways/istio-ingress/templates/autoscale.yaml
// charts/gateways/istio-ingress/templates/certificate.yaml
// charts/gateways/istio-ingress/templates/deployment.yaml
// charts/gateways/istio-ingress/templates/gateway.yaml
// charts/gateways/istio-ingress/templates/hosts.yaml
// charts/gateways/istio-ingress/templates/meshexpansion.yaml
// charts/gateways/istio-ingress/templates/poddisruptionbudget.yaml
// charts/gateways/istio-ingress/templates/preconfigured.yaml
// charts/gateways/istio-ingress/templates/role.yaml
// charts/gateways/istio-ingress/templates/rolebindings.yaml
// charts/gateways/istio-ingress/templates/service.yaml
// charts/gateways/istio-ingress/templates/serviceaccount.yaml
// charts/gateways/istio-ingress/templates/sidecar.yaml
// charts/gateways/istio-ingress/values.yaml
// charts/istio-cni/Chart.yaml
// charts/istio-cni/templates/clusterrole.yaml
// charts/istio-cni/templates/clusterrolebinding.yaml
// charts/istio-cni/templates/configmap-cni.yaml
// charts/istio-cni/templates/daemonset.yaml
// charts/istio-cni/templates/serviceaccount.yaml
// charts/istio-cni/values.yaml
// charts/istio-control/istio-autoinject/Chart.yaml
// charts/istio-control/istio-autoinject/NOTES.txt
// charts/istio-control/istio-autoinject/files/injection-template.yaml
// charts/istio-control/istio-autoinject/templates/_affinity.tpl
// charts/istio-control/istio-autoinject/templates/_helpers.tpl
// charts/istio-control/istio-autoinject/templates/clusterrole.yaml
// charts/istio-control/istio-autoinject/templates/clusterrolebinding.yaml
// charts/istio-control/istio-autoinject/templates/configmap.yaml
// charts/istio-control/istio-autoinject/templates/deployment.yaml
// charts/istio-control/istio-autoinject/templates/mutatingwebhook.yaml
// charts/istio-control/istio-autoinject/templates/poddisruptionbudget.yaml
// charts/istio-control/istio-autoinject/templates/service.yaml
// charts/istio-control/istio-autoinject/templates/serviceaccount.yaml
// charts/istio-control/istio-autoinject/templates/sidecar-injector-configmap.yaml
// charts/istio-control/istio-autoinject/values.yaml
// charts/istio-control/istio-config/Chart.yaml
// charts/istio-control/istio-config/OWNERS
// charts/istio-control/istio-config/README.md
// charts/istio-control/istio-config/templates/_affinity.tpl
// charts/istio-control/istio-config/templates/_helpers.tpl
// charts/istio-control/istio-config/templates/clusterrole.yaml
// charts/istio-control/istio-config/templates/clusterrolebinding.yaml
// charts/istio-control/istio-config/templates/configmap-envoy.yaml
// charts/istio-control/istio-config/templates/configmap-mesh.yaml
// charts/istio-control/istio-config/templates/configmap.yaml
// charts/istio-control/istio-config/templates/deployment.yaml
// charts/istio-control/istio-config/templates/poddisruptionbudget.yaml
// charts/istio-control/istio-config/templates/service.yaml
// charts/istio-control/istio-config/templates/serviceaccount.yaml
// charts/istio-control/istio-config/templates/validatingwebhookconfiguration.yaml
// charts/istio-control/istio-config/templates/validatingwebhookconfiguration.yaml.tpl
// charts/istio-control/istio-config/values.yaml
// charts/istio-control/istio-discovery/Chart.yaml
// charts/istio-control/istio-discovery/NOTES.txt
// charts/istio-control/istio-discovery/files/injection-template.yaml
// charts/istio-control/istio-discovery/templates/_affinity.tpl
// charts/istio-control/istio-discovery/templates/_helpers.tpl
// charts/istio-control/istio-discovery/templates/autoscale.yaml
// charts/istio-control/istio-discovery/templates/clusterrole-galley-disable-webhook.yaml
// charts/istio-control/istio-discovery/templates/clusterrole.yaml
// charts/istio-control/istio-discovery/templates/clusterrolebinding.yaml
// charts/istio-control/istio-discovery/templates/configmap-envoy.yaml
// charts/istio-control/istio-discovery/templates/configmap-jwks.yaml
// charts/istio-control/istio-discovery/templates/configmap.yaml
// charts/istio-control/istio-discovery/templates/deployment.yaml
// charts/istio-control/istio-discovery/templates/enable-mesh-mtls.yaml
// charts/istio-control/istio-discovery/templates/istiod-injector-configmap.yaml
// charts/istio-control/istio-discovery/templates/mutatingwebhook.yaml
// charts/istio-control/istio-discovery/templates/poddisruptionbudget.yaml
// charts/istio-control/istio-discovery/templates/service.yaml
// charts/istio-control/istio-discovery/templates/serviceaccount.yaml
// charts/istio-control/istio-discovery/templates/telemetryv2_1.4.yaml
// charts/istio-control/istio-discovery/templates/telemetryv2_1.5.yaml
// charts/istio-control/istio-discovery/templates/validatingwebhookconfiguration.yaml
// charts/istio-control/istio-discovery/values.yaml
// charts/istio-operator/Chart.yaml
// charts/istio-operator/templates/clusterrole.yaml
// charts/istio-operator/templates/clusterrole_binding.yaml
// charts/istio-operator/templates/crd.yaml
// charts/istio-operator/templates/deployment.yaml
// charts/istio-operator/templates/namespace.yaml
// charts/istio-operator/templates/service.yaml
// charts/istio-operator/templates/service_account.yaml
// charts/istio-operator/values.yaml
// charts/istio-policy/Chart.yaml
// charts/istio-policy/templates/_affinity.tpl
// charts/istio-policy/templates/_helpers.tpl
// charts/istio-policy/templates/autoscale.yaml
// charts/istio-policy/templates/clusterrole.yaml
// charts/istio-policy/templates/clusterrolebinding.yaml
// charts/istio-policy/templates/config.yaml
// charts/istio-policy/templates/deployment.yaml
// charts/istio-policy/templates/poddisruptionbudget.yaml
// charts/istio-policy/templates/service.yaml
// charts/istio-policy/templates/serviceaccount.yaml
// charts/istio-policy/values.yaml
// charts/istio-telemetry/grafana/Chart.yaml
// charts/istio-telemetry/grafana/dashboards/citadel-dashboard.json
// charts/istio-telemetry/grafana/dashboards/galley-dashboard.json
// charts/istio-telemetry/grafana/dashboards/istio-mesh-dashboard.json
// charts/istio-telemetry/grafana/dashboards/istio-performance-dashboard.json
// charts/istio-telemetry/grafana/dashboards/istio-service-dashboard.json
// charts/istio-telemetry/grafana/dashboards/istio-workload-dashboard.json
// charts/istio-telemetry/grafana/dashboards/mixer-dashboard.json
// charts/istio-telemetry/grafana/dashboards/pilot-dashboard.json
// charts/istio-telemetry/grafana/fix_datasources.sh
// charts/istio-telemetry/grafana/templates/_affinity.tpl
// charts/istio-telemetry/grafana/templates/configmap-dashboards.yaml
// charts/istio-telemetry/grafana/templates/configmap.yaml
// charts/istio-telemetry/grafana/templates/deployment.yaml
// charts/istio-telemetry/grafana/templates/grafana-policy.yaml
// charts/istio-telemetry/grafana/templates/pvc.yaml
// charts/istio-telemetry/grafana/templates/service.yaml
// charts/istio-telemetry/grafana/templates/tests/test-grafana-connection.yaml
// charts/istio-telemetry/grafana/values.yaml
// charts/istio-telemetry/kiali/Chart.yaml
// charts/istio-telemetry/kiali/templates/_affinity.tpl
// charts/istio-telemetry/kiali/templates/clusterrole.yaml
// charts/istio-telemetry/kiali/templates/clusterrolebinding.yaml
// charts/istio-telemetry/kiali/templates/configmap.yaml
// charts/istio-telemetry/kiali/templates/demosecret.yaml
// charts/istio-telemetry/kiali/templates/deployment.yaml
// charts/istio-telemetry/kiali/templates/service.yaml
// charts/istio-telemetry/kiali/templates/serviceaccount.yaml
// charts/istio-telemetry/kiali/values.yaml
// charts/istio-telemetry/mixer-telemetry/Chart.yaml
// charts/istio-telemetry/mixer-telemetry/templates/_affinity.tpl
// charts/istio-telemetry/mixer-telemetry/templates/autoscale.yaml
// charts/istio-telemetry/mixer-telemetry/templates/clusterrole.yaml
// charts/istio-telemetry/mixer-telemetry/templates/clusterrolebinding.yaml
// charts/istio-telemetry/mixer-telemetry/templates/config.yaml
// charts/istio-telemetry/mixer-telemetry/templates/configmap-envoy.yaml
// charts/istio-telemetry/mixer-telemetry/templates/deployment.yaml
// charts/istio-telemetry/mixer-telemetry/templates/poddisruptionbudget.yaml
// charts/istio-telemetry/mixer-telemetry/templates/service.yaml
// charts/istio-telemetry/mixer-telemetry/templates/serviceaccount.yaml
// charts/istio-telemetry/mixer-telemetry/templates/stackdriver.yaml
// charts/istio-telemetry/mixer-telemetry/values.yaml
// charts/istio-telemetry/prometheus/Chart.yaml
// charts/istio-telemetry/prometheus/templates/_affinity.tpl
// charts/istio-telemetry/prometheus/templates/clusterrole.yaml
// charts/istio-telemetry/prometheus/templates/clusterrolebindings.yaml
// charts/istio-telemetry/prometheus/templates/configmap.yaml
// charts/istio-telemetry/prometheus/templates/deployment.yaml
// charts/istio-telemetry/prometheus/templates/ingress.yaml
// charts/istio-telemetry/prometheus/templates/service.yaml
// charts/istio-telemetry/prometheus/templates/serviceaccount.yaml
// charts/istio-telemetry/prometheus/templates/tests/test-prometheus-connection.yaml
// charts/istio-telemetry/prometheus/values.yaml
// charts/istio-telemetry/prometheus-operator/Chart.yaml
// charts/istio-telemetry/prometheus-operator/templates/_affinity.tpl
// charts/istio-telemetry/prometheus-operator/templates/prometheus.yaml
// charts/istio-telemetry/prometheus-operator/templates/servicemonitors.yaml
// charts/istio-telemetry/prometheus-operator/values.yaml
// charts/istio-telemetry/tracing/Chart.yaml
// charts/istio-telemetry/tracing/templates/_affinity.tpl
// charts/istio-telemetry/tracing/templates/deployment-jaeger.yaml
// charts/istio-telemetry/tracing/templates/deployment-opencensus.yaml
// charts/istio-telemetry/tracing/templates/deployment-zipkin.yaml
// charts/istio-telemetry/tracing/templates/pvc.yaml
// charts/istio-telemetry/tracing/templates/service-jaeger.yaml
// charts/istio-telemetry/tracing/templates/service.yaml
// charts/istio-telemetry/tracing/values.yaml
// charts/istiocoredns/Chart.yaml
// charts/istiocoredns/templates/_affinity.tpl
// charts/istiocoredns/templates/clusterrole.yaml
// charts/istiocoredns/templates/clusterrolebinding.yaml
// charts/istiocoredns/templates/configmap.yaml
// charts/istiocoredns/templates/deployment.yaml
// charts/istiocoredns/templates/service.yaml
// charts/istiocoredns/templates/serviceaccount.yaml
// charts/istiocoredns/values.yaml
// charts/security/citadel/Chart.yaml
// charts/security/citadel/templates/NOTES.txt
// charts/security/citadel/templates/_affinity.tpl
// charts/security/citadel/templates/_helpers.tpl
// charts/security/citadel/templates/clusterrole.yaml
// charts/security/citadel/templates/clusterrolebinding.yaml
// charts/security/citadel/templates/deployment.yaml
// charts/security/citadel/templates/poddisruptionbudget.yaml
// charts/security/citadel/templates/service.yaml
// charts/security/citadel/templates/serviceaccount.yaml
// charts/security/citadel/values.yaml
// charts/security/nodeagent/Chart.yaml
// charts/security/nodeagent/templates/_affinity.tpl
// charts/security/nodeagent/templates/clusterrole.yaml
// charts/security/nodeagent/templates/clusterrolebinding.yaml
// charts/security/nodeagent/templates/daemonset.yaml
// charts/security/nodeagent/templates/serviceaccount.yaml
// charts/security/nodeagent/values.yaml
// examples/customresource/istio_v1alpha1_istiooperator_cr.yaml
// examples/googleca/values-istio-google-ca.yaml
// examples/multicluster/values-istio-multicluster-gateways.yaml
// examples/multicluster/values-istio-multicluster-primary.yaml
// examples/user-gateway/ingress-gateway-only.yaml
// examples/vm/values-istio-meshexpansion-gateways.yaml
// examples/vm/values-istio-meshexpansion.yaml
// operator-chart/Chart.yaml
// operator-chart/templates/clusterrole.yaml
// operator-chart/templates/clusterrole_binding.yaml
// operator-chart/templates/crd.yaml
// operator-chart/templates/deployment.yaml
// operator-chart/templates/namespace.yaml
// operator-chart/templates/service.yaml
// operator-chart/templates/service_account.yaml
// profiles/default.yaml
// profiles/demo.yaml
// profiles/empty.yaml
// profiles/minimal.yaml
// profiles/remote.yaml
// profiles/separate.yaml
// translateConfig/names-1.5.yaml
// translateConfig/reverseTranslateConfig-1.4.yaml
// translateConfig/reverseTranslateConfig-1.5.yaml
// translateConfig/translate-ICP-IOP-1.5.yaml
// translateConfig/translateConfig-1.3.yaml
// translateConfig/translateConfig-1.4.yaml
// translateConfig/translateConfig-1.5.yaml
// versions.yaml
package vfs

import (
	"fmt"
	"io/ioutil"
	"os"
	"path/filepath"
	"strings"
	"time"
)
type asset struct {
	bytes []byte
	info  os.FileInfo
}

type bindataFileInfo struct {
	name    string
	size    int64
	mode    os.FileMode
	modTime time.Time
}

// Name return file name
func (fi bindataFileInfo) Name() string {
	return fi.name
}

// Size return file size
func (fi bindataFileInfo) Size() int64 {
	return fi.size
}

// Mode return file mode
func (fi bindataFileInfo) Mode() os.FileMode {
	return fi.mode
}

// Mode return file modify time
func (fi bindataFileInfo) ModTime() time.Time {
	return fi.modTime
}

// IsDir return file whether a directory
func (fi bindataFileInfo) IsDir() bool {
	return fi.mode&os.ModeDir != 0
}

// Sys return file is sys mode
func (fi bindataFileInfo) Sys() interface{} {
	return nil
}

var _chartsBaseChartYaml = []byte(`apiVersion: v1
name: base
version: 1.1.0
tillerVersion: ">=2.7.2"
description: Helm chart for deploying Istio base components
keywords:
  - istio
sources:
  - http://github.com/istio/istio
engine: gotpl
icon: https://istio.io/favicons/android-192x192.png
`)

func chartsBaseChartYamlBytes() ([]byte, error) {
	return _chartsBaseChartYaml, nil
}

func chartsBaseChartYaml() (*asset, error) {
	bytes, err := chartsBaseChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/base/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsBaseFilesCrdAllGenYaml = []byte(`# DO NOT EDIT - Generated by Cue OpenAPI generator based on Istio APIs.
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-citadel
    chart: istio
    heritage: Tiller
    release: istio
  name: meshpolicies.authentication.istio.io
spec:
  group: authentication.istio.io
  names:
    categories:
    - istio-io
    - authentication-istio-io
    kind: MeshPolicy
    listKind: MeshPolicyList
    plural: meshpolicies
    singular: meshpolicy
  scope: Cluster
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: 'Authentication policy for Istio services. See more details
            at: https://istio.io/docs/reference/config/security/istio.authentication.v1alpha1.html'
          properties:
            originIsOptional:
              description: Deprecated.
              type: boolean
            origins:
              description: Deprecated.
              items:
                properties:
                  jwt:
                    description: Jwt params for the method.
                    properties:
                      audiences:
                        items:
                          format: string
                          type: string
                        type: array
                      issuer:
                        description: Identifies the issuer that issued the JWT.
                        format: string
                        type: string
                      jwks:
                        description: JSON Web Key Set of public keys to validate signature
                          of the JWT.
                        format: string
                        type: string
                      jwks_uri:
                        format: string
                        type: string
                      jwksUri:
                        format: string
                        type: string
                      jwt_headers:
                        description: JWT is sent in a request header.
                        items:
                          format: string
                          type: string
                        type: array
                      jwtHeaders:
                        description: JWT is sent in a request header.
                        items:
                          format: string
                          type: string
                        type: array
                      jwtParams:
                        description: JWT is sent in a query parameter.
                        items:
                          format: string
                          type: string
                        type: array
                      trigger_rules:
                        items:
                          properties:
                            excluded_paths:
                              description: List of paths to be excluded from the request.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            excludedPaths:
                              description: List of paths to be excluded from the request.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            included_paths:
                              description: List of paths that the request must include.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            includedPaths:
                              description: List of paths that the request must include.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                          type: object
                        type: array
                      triggerRules:
                        items:
                          properties:
                            excluded_paths:
                              description: List of paths to be excluded from the request.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            excludedPaths:
                              description: List of paths to be excluded from the request.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            included_paths:
                              description: List of paths that the request must include.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            includedPaths:
                              description: List of paths that the request must include.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                          type: object
                        type: array
                    type: object
                type: object
              type: array
            peerIsOptional:
              description: Deprecated.
              type: boolean
            peers:
              description: List of authentication methods that can be used for peer
                authentication.
              items:
                oneOf:
                - not:
                    anyOf:
                    - required:
                      - mtls
                    - properties:
                        jwt: {}
                      required:
                      - jwt
                - required:
                  - mtls
                - properties:
                    jwt: {}
                  required:
                  - jwt
                properties:
                  jwt:
                    properties:
                      audiences:
                        items:
                          format: string
                          type: string
                        type: array
                      issuer:
                        description: Identifies the issuer that issued the JWT.
                        format: string
                        type: string
                      jwks:
                        description: JSON Web Key Set of public keys to validate signature
                          of the JWT.
                        format: string
                        type: string
                      jwks_uri:
                        format: string
                        type: string
                      jwksUri:
                        format: string
                        type: string
                      jwt_headers:
                        description: JWT is sent in a request header.
                        items:
                          format: string
                          type: string
                        type: array
                      jwtHeaders:
                        description: JWT is sent in a request header.
                        items:
                          format: string
                          type: string
                        type: array
                      jwtParams:
                        description: JWT is sent in a query parameter.
                        items:
                          format: string
                          type: string
                        type: array
                      trigger_rules:
                        items:
                          properties:
                            excluded_paths:
                              description: List of paths to be excluded from the request.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            excludedPaths:
                              description: List of paths to be excluded from the request.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            included_paths:
                              description: List of paths that the request must include.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            includedPaths:
                              description: List of paths that the request must include.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                          type: object
                        type: array
                      triggerRules:
                        items:
                          properties:
                            excluded_paths:
                              description: List of paths to be excluded from the request.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            excludedPaths:
                              description: List of paths to be excluded from the request.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            included_paths:
                              description: List of paths that the request must include.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            includedPaths:
                              description: List of paths that the request must include.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                          type: object
                        type: array
                    type: object
                  mtls:
                    description: Set if mTLS is used.
                    properties:
                      allowTls:
                        description: Deprecated.
                        type: boolean
                      mode:
                        description: Defines the mode of mTLS authentication.
                        enum:
                        - STRICT
                        - PERMISSIVE
                        type: string
                    type: object
                type: object
              type: array
            principalBinding:
              description: Deprecated.
              enum:
              - USE_PEER
              - USE_ORIGIN
              type: string
            targets:
              description: Deprecated.
              items:
                properties:
                  name:
                    description: The name must be a short name from the service registry.
                    format: string
                    type: string
                  ports:
                    description: Specifies the ports.
                    items:
                      oneOf:
                      - not:
                          anyOf:
                          - required:
                            - number
                          - required:
                            - name
                      - required:
                        - number
                      - required:
                        - name
                      properties:
                        name:
                          format: string
                          type: string
                        number:
                          type: integer
                      type: object
                    type: array
                type: object
              type: array
          type: object
      type: object
  versions:
  - name: v1alpha1
    served: true
    storage: true

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-citadel
    chart: istio
    heritage: Tiller
    release: istio
  name: policies.authentication.istio.io
spec:
  group: authentication.istio.io
  names:
    categories:
    - istio-io
    - authentication-istio-io
    kind: Policy
    listKind: PolicyList
    plural: policies
    singular: policy
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: 'Authentication policy for Istio services. See more details
            at: https://istio.io/docs/reference/config/security/istio.authentication.v1alpha1.html'
          properties:
            originIsOptional:
              description: Deprecated.
              type: boolean
            origins:
              description: Deprecated.
              items:
                properties:
                  jwt:
                    description: Jwt params for the method.
                    properties:
                      audiences:
                        items:
                          format: string
                          type: string
                        type: array
                      issuer:
                        description: Identifies the issuer that issued the JWT.
                        format: string
                        type: string
                      jwks:
                        description: JSON Web Key Set of public keys to validate signature
                          of the JWT.
                        format: string
                        type: string
                      jwks_uri:
                        format: string
                        type: string
                      jwksUri:
                        format: string
                        type: string
                      jwt_headers:
                        description: JWT is sent in a request header.
                        items:
                          format: string
                          type: string
                        type: array
                      jwtHeaders:
                        description: JWT is sent in a request header.
                        items:
                          format: string
                          type: string
                        type: array
                      jwtParams:
                        description: JWT is sent in a query parameter.
                        items:
                          format: string
                          type: string
                        type: array
                      trigger_rules:
                        items:
                          properties:
                            excluded_paths:
                              description: List of paths to be excluded from the request.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            excludedPaths:
                              description: List of paths to be excluded from the request.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            included_paths:
                              description: List of paths that the request must include.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            includedPaths:
                              description: List of paths that the request must include.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                          type: object
                        type: array
                      triggerRules:
                        items:
                          properties:
                            excluded_paths:
                              description: List of paths to be excluded from the request.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            excludedPaths:
                              description: List of paths to be excluded from the request.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            included_paths:
                              description: List of paths that the request must include.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            includedPaths:
                              description: List of paths that the request must include.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                          type: object
                        type: array
                    type: object
                type: object
              type: array
            peerIsOptional:
              description: Deprecated.
              type: boolean
            peers:
              description: List of authentication methods that can be used for peer
                authentication.
              items:
                oneOf:
                - not:
                    anyOf:
                    - required:
                      - mtls
                    - properties:
                        jwt: {}
                      required:
                      - jwt
                - required:
                  - mtls
                - properties:
                    jwt: {}
                  required:
                  - jwt
                properties:
                  jwt:
                    properties:
                      audiences:
                        items:
                          format: string
                          type: string
                        type: array
                      issuer:
                        description: Identifies the issuer that issued the JWT.
                        format: string
                        type: string
                      jwks:
                        description: JSON Web Key Set of public keys to validate signature
                          of the JWT.
                        format: string
                        type: string
                      jwks_uri:
                        format: string
                        type: string
                      jwksUri:
                        format: string
                        type: string
                      jwt_headers:
                        description: JWT is sent in a request header.
                        items:
                          format: string
                          type: string
                        type: array
                      jwtHeaders:
                        description: JWT is sent in a request header.
                        items:
                          format: string
                          type: string
                        type: array
                      jwtParams:
                        description: JWT is sent in a query parameter.
                        items:
                          format: string
                          type: string
                        type: array
                      trigger_rules:
                        items:
                          properties:
                            excluded_paths:
                              description: List of paths to be excluded from the request.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            excludedPaths:
                              description: List of paths to be excluded from the request.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            included_paths:
                              description: List of paths that the request must include.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            includedPaths:
                              description: List of paths that the request must include.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                          type: object
                        type: array
                      triggerRules:
                        items:
                          properties:
                            excluded_paths:
                              description: List of paths to be excluded from the request.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            excludedPaths:
                              description: List of paths to be excluded from the request.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            included_paths:
                              description: List of paths that the request must include.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                            includedPaths:
                              description: List of paths that the request must include.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - exact
                                    - required:
                                      - prefix
                                    - required:
                                      - suffix
                                    - required:
                                      - regex
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - suffix
                                - required:
                                  - regex
                                properties:
                                  exact:
                                    description: exact string match.
                                    format: string
                                    type: string
                                  prefix:
                                    description: prefix-based match.
                                    format: string
                                    type: string
                                  regex:
                                    description: ECMAscript style regex-based match
                                      as defined by [EDCA-262](http://en.cppreference.com/w/cpp/regex/ecmascript).
                                    format: string
                                    type: string
                                  suffix:
                                    description: suffix-based match.
                                    format: string
                                    type: string
                                type: object
                              type: array
                          type: object
                        type: array
                    type: object
                  mtls:
                    description: Set if mTLS is used.
                    properties:
                      allowTls:
                        description: Deprecated.
                        type: boolean
                      mode:
                        description: Defines the mode of mTLS authentication.
                        enum:
                        - STRICT
                        - PERMISSIVE
                        type: string
                    type: object
                type: object
              type: array
            principalBinding:
              description: Deprecated.
              enum:
              - USE_PEER
              - USE_ORIGIN
              type: string
            targets:
              description: Deprecated.
              items:
                properties:
                  name:
                    description: The name must be a short name from the service registry.
                    format: string
                    type: string
                  ports:
                    description: Specifies the ports.
                    items:
                      oneOf:
                      - not:
                          anyOf:
                          - required:
                            - number
                          - required:
                            - name
                      - required:
                        - number
                      - required:
                        - name
                      properties:
                        name:
                          format: string
                          type: string
                        number:
                          type: integer
                      type: object
                    type: array
                type: object
              type: array
          type: object
      type: object
  versions:
  - name: v1alpha1
    served: true
    storage: true

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-mixer
    chart: istio
    heritage: Tiller
    release: istio
  name: httpapispecs.config.istio.io
spec:
  group: config.istio.io
  names:
    categories:
    - istio-io
    - apim-istio-io
    kind: HTTPAPISpec
    listKind: HTTPAPISpecList
    plural: httpapispecs
    singular: httpapispec
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          properties:
            api_keys:
              items:
                oneOf:
                - not:
                    anyOf:
                    - required:
                      - query
                    - required:
                      - header
                    - required:
                      - cookie
                - required:
                  - query
                - required:
                  - header
                - required:
                  - cookie
                properties:
                  cookie:
                    format: string
                    type: string
                  header:
                    description: API key is sent in a request header.
                    format: string
                    type: string
                  query:
                    description: API Key is sent as a query parameter.
                    format: string
                    type: string
                type: object
              type: array
            apiKeys:
              items:
                oneOf:
                - not:
                    anyOf:
                    - required:
                      - query
                    - required:
                      - header
                    - required:
                      - cookie
                - required:
                  - query
                - required:
                  - header
                - required:
                  - cookie
                properties:
                  cookie:
                    format: string
                    type: string
                  header:
                    description: API key is sent in a request header.
                    format: string
                    type: string
                  query:
                    description: API Key is sent as a query parameter.
                    format: string
                    type: string
                type: object
              type: array
            attributes:
              properties:
                attributes:
                  additionalProperties:
                    oneOf:
                    - not:
                        anyOf:
                        - required:
                          - stringValue
                        - required:
                          - int64Value
                        - required:
                          - doubleValue
                        - required:
                          - boolValue
                        - required:
                          - bytesValue
                        - required:
                          - timestampValue
                        - required:
                          - durationValue
                        - required:
                          - stringMapValue
                    - required:
                      - stringValue
                    - required:
                      - int64Value
                    - required:
                      - doubleValue
                    - required:
                      - boolValue
                    - required:
                      - bytesValue
                    - required:
                      - timestampValue
                    - required:
                      - durationValue
                    - required:
                      - stringMapValue
                    properties:
                      boolValue:
                        type: boolean
                      bytesValue:
                        format: binary
                        type: string
                      doubleValue:
                        format: double
                        type: number
                      durationValue:
                        type: string
                      int64Value:
                        format: int64
                        type: integer
                      stringMapValue:
                        properties:
                          entries:
                            additionalProperties:
                              format: string
                              type: string
                            description: Holds a set of name/value pairs.
                            type: object
                        type: object
                      stringValue:
                        format: string
                        type: string
                      timestampValue:
                        format: dateTime
                        type: string
                    type: object
                  description: A map of attribute name to its value.
                  type: object
              type: object
            patterns:
              description: List of HTTP patterns to match.
              items:
                oneOf:
                - not:
                    anyOf:
                    - required:
                      - uriTemplate
                    - required:
                      - regex
                - required:
                  - uriTemplate
                - required:
                  - regex
                properties:
                  attributes:
                    properties:
                      attributes:
                        additionalProperties:
                          oneOf:
                          - not:
                              anyOf:
                              - required:
                                - stringValue
                              - required:
                                - int64Value
                              - required:
                                - doubleValue
                              - required:
                                - boolValue
                              - required:
                                - bytesValue
                              - required:
                                - timestampValue
                              - required:
                                - durationValue
                              - required:
                                - stringMapValue
                          - required:
                            - stringValue
                          - required:
                            - int64Value
                          - required:
                            - doubleValue
                          - required:
                            - boolValue
                          - required:
                            - bytesValue
                          - required:
                            - timestampValue
                          - required:
                            - durationValue
                          - required:
                            - stringMapValue
                          properties:
                            boolValue:
                              type: boolean
                            bytesValue:
                              format: binary
                              type: string
                            doubleValue:
                              format: double
                              type: number
                            durationValue:
                              type: string
                            int64Value:
                              format: int64
                              type: integer
                            stringMapValue:
                              properties:
                                entries:
                                  additionalProperties:
                                    format: string
                                    type: string
                                  description: Holds a set of name/value pairs.
                                  type: object
                              type: object
                            stringValue:
                              format: string
                              type: string
                            timestampValue:
                              format: dateTime
                              type: string
                          type: object
                        description: A map of attribute name to its value.
                        type: object
                    type: object
                  httpMethod:
                    format: string
                    type: string
                  regex:
                    format: string
                    type: string
                  uriTemplate:
                    format: string
                    type: string
                type: object
              type: array
          type: object
      type: object
  versions:
  - name: v1alpha2
    served: true
    storage: true

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-mixer
    chart: istio
    heritage: Tiller
    release: istio
  name: httpapispecbindings.config.istio.io
spec:
  group: config.istio.io
  names:
    categories:
    - istio-io
    - apim-istio-io
    kind: HTTPAPISpecBinding
    listKind: HTTPAPISpecBindingList
    plural: httpapispecbindings
    singular: httpapispecbinding
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          properties:
            api_specs:
              items:
                properties:
                  name:
                    description: The short name of the HTTPAPISpec.
                    format: string
                    type: string
                  namespace:
                    description: Optional namespace of the HTTPAPISpec.
                    format: string
                    type: string
                type: object
              type: array
            apiSpecs:
              items:
                properties:
                  name:
                    description: The short name of the HTTPAPISpec.
                    format: string
                    type: string
                  namespace:
                    description: Optional namespace of the HTTPAPISpec.
                    format: string
                    type: string
                type: object
              type: array
            services:
              description: One or more services to map the listed HTTPAPISpec onto.
              items:
                properties:
                  domain:
                    description: Domain suffix used to construct the service FQDN
                      in implementations that support such specification.
                    format: string
                    type: string
                  labels:
                    additionalProperties:
                      format: string
                      type: string
                    description: Optional one or more labels that uniquely identify
                      the service version.
                    type: object
                  name:
                    description: The short name of the service such as "foo".
                    format: string
                    type: string
                  namespace:
                    description: Optional namespace of the service.
                    format: string
                    type: string
                  service:
                    description: The service FQDN.
                    format: string
                    type: string
                type: object
              type: array
          type: object
      type: object
  versions:
  - name: v1alpha2
    served: true
    storage: true

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-mixer
    chart: istio
    heritage: Tiller
    release: istio
  name: quotaspecs.config.istio.io
spec:
  group: config.istio.io
  names:
    categories:
    - istio-io
    - apim-istio-io
    kind: QuotaSpec
    listKind: QuotaSpecList
    plural: quotaspecs
    singular: quotaspec
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: Determines the quotas used for individual requests.
          properties:
            rules:
              description: A list of Quota rules.
              items:
                properties:
                  match:
                    description: If empty, match all request.
                    items:
                      properties:
                        clause:
                          additionalProperties:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - regex
                            - required:
                              - exact
                            - required:
                              - prefix
                            - required:
                              - regex
                            properties:
                              exact:
                                format: string
                                type: string
                              prefix:
                                format: string
                                type: string
                              regex:
                                format: string
                                type: string
                            type: object
                          description: Map of attribute names to StringMatch type.
                          type: object
                      type: object
                    type: array
                  quotas:
                    description: The list of quotas to charge.
                    items:
                      properties:
                        charge:
                          format: int32
                          type: integer
                        quota:
                          format: string
                          type: string
                      type: object
                    type: array
                type: object
              type: array
          type: object
      type: object
  versions:
  - name: v1alpha2
    served: true
    storage: true

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-mixer
    chart: istio
    heritage: Tiller
    release: istio
  name: quotaspecbindings.config.istio.io
spec:
  group: config.istio.io
  names:
    categories:
    - istio-io
    - apim-istio-io
    kind: QuotaSpecBinding
    listKind: QuotaSpecBindingList
    plural: quotaspecbindings
    singular: quotaspecbinding
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          properties:
            quotaSpecs:
              items:
                properties:
                  name:
                    description: The short name of the QuotaSpec.
                    format: string
                    type: string
                  namespace:
                    description: Optional namespace of the QuotaSpec.
                    format: string
                    type: string
                type: object
              type: array
            services:
              description: One or more services to map the listed QuotaSpec onto.
              items:
                properties:
                  domain:
                    description: Domain suffix used to construct the service FQDN
                      in implementations that support such specification.
                    format: string
                    type: string
                  labels:
                    additionalProperties:
                      format: string
                      type: string
                    description: Optional one or more labels that uniquely identify
                      the service version.
                    type: object
                  name:
                    description: The short name of the service such as "foo".
                    format: string
                    type: string
                  namespace:
                    description: Optional namespace of the service.
                    format: string
                    type: string
                  service:
                    description: The service FQDN.
                    format: string
                    type: string
                type: object
              type: array
          type: object
      type: object
  versions:
  - name: v1alpha2
    served: true
    storage: true

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-pilot
    chart: istio
    heritage: Tiller
    release: istio
  name: destinationrules.networking.istio.io
spec:
  additionalPrinterColumns:
  - JSONPath: .spec.host
    description: The name of a service from the service registry
    name: Host
    type: string
  - JSONPath: .metadata.creationTimestamp
    description: 'CreationTimestamp is a timestamp representing the server time when
      this object was created. It is not guaranteed to be set in happens-before order
      across separate operations. Clients may not set this value. It is represented
      in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
      lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
    name: Age
    type: date
  group: networking.istio.io
  names:
    categories:
    - istio-io
    - networking-istio-io
    kind: DestinationRule
    listKind: DestinationRuleList
    plural: destinationrules
    shortNames:
    - dr
    singular: destinationrule
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: 'Configuration affecting load balancing, outlier detection,
            etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html'
          properties:
            exportTo:
              description: A list of namespaces to which this destination rule is
                exported.
              items:
                format: string
                type: string
              type: array
            host:
              description: The name of a service from the service registry.
              format: string
              type: string
            subsets:
              items:
                properties:
                  labels:
                    additionalProperties:
                      format: string
                      type: string
                    type: object
                  name:
                    description: Name of the subset.
                    format: string
                    type: string
                  trafficPolicy:
                    description: Traffic policies that apply to this subset.
                    properties:
                      connectionPool:
                        properties:
                          http:
                            description: HTTP connection pool settings.
                            properties:
                              h2UpgradePolicy:
                                description: Specify if http1.1 connection should
                                  be upgraded to http2 for the associated destination.
                                enum:
                                - DEFAULT
                                - DO_NOT_UPGRADE
                                - UPGRADE
                                type: string
                              http1MaxPendingRequests:
                                description: Maximum number of pending HTTP requests
                                  to a destination.
                                format: int32
                                type: integer
                              http2MaxRequests:
                                description: Maximum number of requests to a backend.
                                format: int32
                                type: integer
                              idleTimeout:
                                description: The idle timeout for upstream connection
                                  pool connections.
                                type: string
                              maxRequestsPerConnection:
                                description: Maximum number of requests per connection
                                  to a backend.
                                format: int32
                                type: integer
                              maxRetries:
                                format: int32
                                type: integer
                            type: object
                          tcp:
                            description: Settings common to both HTTP and TCP upstream
                              connections.
                            properties:
                              connectTimeout:
                                description: TCP connection timeout.
                                type: string
                              maxConnections:
                                description: Maximum number of HTTP1 /TCP connections
                                  to a destination host.
                                format: int32
                                type: integer
                              tcpKeepalive:
                                description: If set then set SO_KEEPALIVE on the socket
                                  to enable TCP Keepalives.
                                properties:
                                  interval:
                                    description: The time duration between keep-alive
                                      probes.
                                    type: string
                                  probes:
                                    type: integer
                                  time:
                                    type: string
                                type: object
                            type: object
                        type: object
                      loadBalancer:
                        description: Settings controlling the load balancer algorithms.
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - simple
                            - properties:
                                consistentHash:
                                  oneOf:
                                  - not:
                                      anyOf:
                                      - required:
                                        - httpHeaderName
                                      - required:
                                        - httpCookie
                                      - required:
                                        - useSourceIp
                                  - required:
                                    - httpHeaderName
                                  - required:
                                    - httpCookie
                                  - required:
                                    - useSourceIp
                              required:
                              - consistentHash
                        - required:
                          - simple
                        - properties:
                            consistentHash:
                              oneOf:
                              - not:
                                  anyOf:
                                  - required:
                                    - httpHeaderName
                                  - required:
                                    - httpCookie
                                  - required:
                                    - useSourceIp
                              - required:
                                - httpHeaderName
                              - required:
                                - httpCookie
                              - required:
                                - useSourceIp
                          required:
                          - consistentHash
                        properties:
                          consistentHash:
                            properties:
                              httpCookie:
                                description: Hash based on HTTP cookie.
                                properties:
                                  name:
                                    description: Name of the cookie.
                                    format: string
                                    type: string
                                  path:
                                    description: Path to set for the cookie.
                                    format: string
                                    type: string
                                  ttl:
                                    description: Lifetime of the cookie.
                                    type: string
                                type: object
                              httpHeaderName:
                                description: Hash based on a specific HTTP header.
                                format: string
                                type: string
                              minimumRingSize:
                                type: integer
                              useSourceIp:
                                description: Hash based on the source IP address.
                                type: boolean
                            type: object
                          localityLbSetting:
                            properties:
                              distribute:
                                description: 'Optional: only one of distribute or
                                  failover can be set.'
                                items:
                                  properties:
                                    from:
                                      description: Originating locality, '/' separated,
                                        e.g.
                                      format: string
                                      type: string
                                    to:
                                      additionalProperties:
                                        type: integer
                                      description: Map of upstream localities to traffic
                                        distribution weights.
                                      type: object
                                  type: object
                                type: array
                              enabled:
                                description: enable locality load balancing, this
                                  is DestinationRule-level and will override mesh
                                  wide settings in entirety.
                                type: boolean
                              failover:
                                description: 'Optional: only failover or distribute
                                  can be set.'
                                items:
                                  properties:
                                    from:
                                      description: Originating region.
                                      format: string
                                      type: string
                                    to:
                                      format: string
                                      type: string
                                  type: object
                                type: array
                            type: object
                          simple:
                            enum:
                            - ROUND_ROBIN
                            - LEAST_CONN
                            - RANDOM
                            - PASSTHROUGH
                            type: string
                        type: object
                      outlierDetection:
                        properties:
                          baseEjectionTime:
                            description: Minimum ejection duration.
                            type: string
                          consecutive5xxErrors:
                            description: Number of 5xx errors before a host is ejected
                              from the connection pool.
                            type: integer
                          consecutiveErrors:
                            format: int32
                            type: integer
                          consecutiveGatewayErrors:
                            description: Number of gateway errors before a host is
                              ejected from the connection pool.
                            type: integer
                          interval:
                            description: Time interval between ejection sweep analysis.
                            type: string
                          maxEjectionPercent:
                            format: int32
                            type: integer
                          minHealthPercent:
                            format: int32
                            type: integer
                        type: object
                      portLevelSettings:
                        description: Traffic policies specific to individual ports.
                        items:
                          properties:
                            connectionPool:
                              properties:
                                http:
                                  description: HTTP connection pool settings.
                                  properties:
                                    h2UpgradePolicy:
                                      description: Specify if http1.1 connection should
                                        be upgraded to http2 for the associated destination.
                                      enum:
                                      - DEFAULT
                                      - DO_NOT_UPGRADE
                                      - UPGRADE
                                      type: string
                                    http1MaxPendingRequests:
                                      description: Maximum number of pending HTTP
                                        requests to a destination.
                                      format: int32
                                      type: integer
                                    http2MaxRequests:
                                      description: Maximum number of requests to a
                                        backend.
                                      format: int32
                                      type: integer
                                    idleTimeout:
                                      description: The idle timeout for upstream connection
                                        pool connections.
                                      type: string
                                    maxRequestsPerConnection:
                                      description: Maximum number of requests per
                                        connection to a backend.
                                      format: int32
                                      type: integer
                                    maxRetries:
                                      format: int32
                                      type: integer
                                  type: object
                                tcp:
                                  description: Settings common to both HTTP and TCP
                                    upstream connections.
                                  properties:
                                    connectTimeout:
                                      description: TCP connection timeout.
                                      type: string
                                    maxConnections:
                                      description: Maximum number of HTTP1 /TCP connections
                                        to a destination host.
                                      format: int32
                                      type: integer
                                    tcpKeepalive:
                                      description: If set then set SO_KEEPALIVE on
                                        the socket to enable TCP Keepalives.
                                      properties:
                                        interval:
                                          description: The time duration between keep-alive
                                            probes.
                                          type: string
                                        probes:
                                          type: integer
                                        time:
                                          type: string
                                      type: object
                                  type: object
                              type: object
                            loadBalancer:
                              description: Settings controlling the load balancer
                                algorithms.
                              oneOf:
                              - not:
                                  anyOf:
                                  - required:
                                    - simple
                                  - properties:
                                      consistentHash:
                                        oneOf:
                                        - not:
                                            anyOf:
                                            - required:
                                              - httpHeaderName
                                            - required:
                                              - httpCookie
                                            - required:
                                              - useSourceIp
                                        - required:
                                          - httpHeaderName
                                        - required:
                                          - httpCookie
                                        - required:
                                          - useSourceIp
                                    required:
                                    - consistentHash
                              - required:
                                - simple
                              - properties:
                                  consistentHash:
                                    oneOf:
                                    - not:
                                        anyOf:
                                        - required:
                                          - httpHeaderName
                                        - required:
                                          - httpCookie
                                        - required:
                                          - useSourceIp
                                    - required:
                                      - httpHeaderName
                                    - required:
                                      - httpCookie
                                    - required:
                                      - useSourceIp
                                required:
                                - consistentHash
                              properties:
                                consistentHash:
                                  properties:
                                    httpCookie:
                                      description: Hash based on HTTP cookie.
                                      properties:
                                        name:
                                          description: Name of the cookie.
                                          format: string
                                          type: string
                                        path:
                                          description: Path to set for the cookie.
                                          format: string
                                          type: string
                                        ttl:
                                          description: Lifetime of the cookie.
                                          type: string
                                      type: object
                                    httpHeaderName:
                                      description: Hash based on a specific HTTP header.
                                      format: string
                                      type: string
                                    minimumRingSize:
                                      type: integer
                                    useSourceIp:
                                      description: Hash based on the source IP address.
                                      type: boolean
                                  type: object
                                localityLbSetting:
                                  properties:
                                    distribute:
                                      description: 'Optional: only one of distribute
                                        or failover can be set.'
                                      items:
                                        properties:
                                          from:
                                            description: Originating locality, '/'
                                              separated, e.g.
                                            format: string
                                            type: string
                                          to:
                                            additionalProperties:
                                              type: integer
                                            description: Map of upstream localities
                                              to traffic distribution weights.
                                            type: object
                                        type: object
                                      type: array
                                    enabled:
                                      description: enable locality load balancing,
                                        this is DestinationRule-level and will override
                                        mesh wide settings in entirety.
                                      type: boolean
                                    failover:
                                      description: 'Optional: only failover or distribute
                                        can be set.'
                                      items:
                                        properties:
                                          from:
                                            description: Originating region.
                                            format: string
                                            type: string
                                          to:
                                            format: string
                                            type: string
                                        type: object
                                      type: array
                                  type: object
                                simple:
                                  enum:
                                  - ROUND_ROBIN
                                  - LEAST_CONN
                                  - RANDOM
                                  - PASSTHROUGH
                                  type: string
                              type: object
                            outlierDetection:
                              properties:
                                baseEjectionTime:
                                  description: Minimum ejection duration.
                                  type: string
                                consecutive5xxErrors:
                                  description: Number of 5xx errors before a host
                                    is ejected from the connection pool.
                                  type: integer
                                consecutiveErrors:
                                  format: int32
                                  type: integer
                                consecutiveGatewayErrors:
                                  description: Number of gateway errors before a host
                                    is ejected from the connection pool.
                                  type: integer
                                interval:
                                  description: Time interval between ejection sweep
                                    analysis.
                                  type: string
                                maxEjectionPercent:
                                  format: int32
                                  type: integer
                                minHealthPercent:
                                  format: int32
                                  type: integer
                              type: object
                            port:
                              properties:
                                number:
                                  type: integer
                              type: object
                            tls:
                              description: TLS related settings for connections to
                                the upstream service.
                              properties:
                                caCertificates:
                                  format: string
                                  type: string
                                clientCertificate:
                                  description: REQUIRED if mode is `+"`"+`MUTUAL`+"`"+`.
                                  format: string
                                  type: string
                                mode:
                                  enum:
                                  - DISABLE
                                  - SIMPLE
                                  - MUTUAL
                                  - ISTIO_MUTUAL
                                  type: string
                                privateKey:
                                  description: REQUIRED if mode is `+"`"+`MUTUAL`+"`"+`.
                                  format: string
                                  type: string
                                sni:
                                  description: SNI string to present to the server
                                    during TLS handshake.
                                  format: string
                                  type: string
                                subjectAltNames:
                                  items:
                                    format: string
                                    type: string
                                  type: array
                              type: object
                          type: object
                        type: array
                      tls:
                        description: TLS related settings for connections to the upstream
                          service.
                        properties:
                          caCertificates:
                            format: string
                            type: string
                          clientCertificate:
                            description: REQUIRED if mode is `+"`"+`MUTUAL`+"`"+`.
                            format: string
                            type: string
                          mode:
                            enum:
                            - DISABLE
                            - SIMPLE
                            - MUTUAL
                            - ISTIO_MUTUAL
                            type: string
                          privateKey:
                            description: REQUIRED if mode is `+"`"+`MUTUAL`+"`"+`.
                            format: string
                            type: string
                          sni:
                            description: SNI string to present to the server during
                              TLS handshake.
                            format: string
                            type: string
                          subjectAltNames:
                            items:
                              format: string
                              type: string
                            type: array
                        type: object
                    type: object
                type: object
              type: array
            trafficPolicy:
              properties:
                connectionPool:
                  properties:
                    http:
                      description: HTTP connection pool settings.
                      properties:
                        h2UpgradePolicy:
                          description: Specify if http1.1 connection should be upgraded
                            to http2 for the associated destination.
                          enum:
                          - DEFAULT
                          - DO_NOT_UPGRADE
                          - UPGRADE
                          type: string
                        http1MaxPendingRequests:
                          description: Maximum number of pending HTTP requests to
                            a destination.
                          format: int32
                          type: integer
                        http2MaxRequests:
                          description: Maximum number of requests to a backend.
                          format: int32
                          type: integer
                        idleTimeout:
                          description: The idle timeout for upstream connection pool
                            connections.
                          type: string
                        maxRequestsPerConnection:
                          description: Maximum number of requests per connection to
                            a backend.
                          format: int32
                          type: integer
                        maxRetries:
                          format: int32
                          type: integer
                      type: object
                    tcp:
                      description: Settings common to both HTTP and TCP upstream connections.
                      properties:
                        connectTimeout:
                          description: TCP connection timeout.
                          type: string
                        maxConnections:
                          description: Maximum number of HTTP1 /TCP connections to
                            a destination host.
                          format: int32
                          type: integer
                        tcpKeepalive:
                          description: If set then set SO_KEEPALIVE on the socket
                            to enable TCP Keepalives.
                          properties:
                            interval:
                              description: The time duration between keep-alive probes.
                              type: string
                            probes:
                              type: integer
                            time:
                              type: string
                          type: object
                      type: object
                  type: object
                loadBalancer:
                  description: Settings controlling the load balancer algorithms.
                  oneOf:
                  - not:
                      anyOf:
                      - required:
                        - simple
                      - properties:
                          consistentHash:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - httpHeaderName
                                - required:
                                  - httpCookie
                                - required:
                                  - useSourceIp
                            - required:
                              - httpHeaderName
                            - required:
                              - httpCookie
                            - required:
                              - useSourceIp
                        required:
                        - consistentHash
                  - required:
                    - simple
                  - properties:
                      consistentHash:
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - httpHeaderName
                            - required:
                              - httpCookie
                            - required:
                              - useSourceIp
                        - required:
                          - httpHeaderName
                        - required:
                          - httpCookie
                        - required:
                          - useSourceIp
                    required:
                    - consistentHash
                  properties:
                    consistentHash:
                      properties:
                        httpCookie:
                          description: Hash based on HTTP cookie.
                          properties:
                            name:
                              description: Name of the cookie.
                              format: string
                              type: string
                            path:
                              description: Path to set for the cookie.
                              format: string
                              type: string
                            ttl:
                              description: Lifetime of the cookie.
                              type: string
                          type: object
                        httpHeaderName:
                          description: Hash based on a specific HTTP header.
                          format: string
                          type: string
                        minimumRingSize:
                          type: integer
                        useSourceIp:
                          description: Hash based on the source IP address.
                          type: boolean
                      type: object
                    localityLbSetting:
                      properties:
                        distribute:
                          description: 'Optional: only one of distribute or failover
                            can be set.'
                          items:
                            properties:
                              from:
                                description: Originating locality, '/' separated,
                                  e.g.
                                format: string
                                type: string
                              to:
                                additionalProperties:
                                  type: integer
                                description: Map of upstream localities to traffic
                                  distribution weights.
                                type: object
                            type: object
                          type: array
                        enabled:
                          description: enable locality load balancing, this is DestinationRule-level
                            and will override mesh wide settings in entirety.
                          type: boolean
                        failover:
                          description: 'Optional: only failover or distribute can
                            be set.'
                          items:
                            properties:
                              from:
                                description: Originating region.
                                format: string
                                type: string
                              to:
                                format: string
                                type: string
                            type: object
                          type: array
                      type: object
                    simple:
                      enum:
                      - ROUND_ROBIN
                      - LEAST_CONN
                      - RANDOM
                      - PASSTHROUGH
                      type: string
                  type: object
                outlierDetection:
                  properties:
                    baseEjectionTime:
                      description: Minimum ejection duration.
                      type: string
                    consecutive5xxErrors:
                      description: Number of 5xx errors before a host is ejected from
                        the connection pool.
                      type: integer
                    consecutiveErrors:
                      format: int32
                      type: integer
                    consecutiveGatewayErrors:
                      description: Number of gateway errors before a host is ejected
                        from the connection pool.
                      type: integer
                    interval:
                      description: Time interval between ejection sweep analysis.
                      type: string
                    maxEjectionPercent:
                      format: int32
                      type: integer
                    minHealthPercent:
                      format: int32
                      type: integer
                  type: object
                portLevelSettings:
                  description: Traffic policies specific to individual ports.
                  items:
                    properties:
                      connectionPool:
                        properties:
                          http:
                            description: HTTP connection pool settings.
                            properties:
                              h2UpgradePolicy:
                                description: Specify if http1.1 connection should
                                  be upgraded to http2 for the associated destination.
                                enum:
                                - DEFAULT
                                - DO_NOT_UPGRADE
                                - UPGRADE
                                type: string
                              http1MaxPendingRequests:
                                description: Maximum number of pending HTTP requests
                                  to a destination.
                                format: int32
                                type: integer
                              http2MaxRequests:
                                description: Maximum number of requests to a backend.
                                format: int32
                                type: integer
                              idleTimeout:
                                description: The idle timeout for upstream connection
                                  pool connections.
                                type: string
                              maxRequestsPerConnection:
                                description: Maximum number of requests per connection
                                  to a backend.
                                format: int32
                                type: integer
                              maxRetries:
                                format: int32
                                type: integer
                            type: object
                          tcp:
                            description: Settings common to both HTTP and TCP upstream
                              connections.
                            properties:
                              connectTimeout:
                                description: TCP connection timeout.
                                type: string
                              maxConnections:
                                description: Maximum number of HTTP1 /TCP connections
                                  to a destination host.
                                format: int32
                                type: integer
                              tcpKeepalive:
                                description: If set then set SO_KEEPALIVE on the socket
                                  to enable TCP Keepalives.
                                properties:
                                  interval:
                                    description: The time duration between keep-alive
                                      probes.
                                    type: string
                                  probes:
                                    type: integer
                                  time:
                                    type: string
                                type: object
                            type: object
                        type: object
                      loadBalancer:
                        description: Settings controlling the load balancer algorithms.
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - simple
                            - properties:
                                consistentHash:
                                  oneOf:
                                  - not:
                                      anyOf:
                                      - required:
                                        - httpHeaderName
                                      - required:
                                        - httpCookie
                                      - required:
                                        - useSourceIp
                                  - required:
                                    - httpHeaderName
                                  - required:
                                    - httpCookie
                                  - required:
                                    - useSourceIp
                              required:
                              - consistentHash
                        - required:
                          - simple
                        - properties:
                            consistentHash:
                              oneOf:
                              - not:
                                  anyOf:
                                  - required:
                                    - httpHeaderName
                                  - required:
                                    - httpCookie
                                  - required:
                                    - useSourceIp
                              - required:
                                - httpHeaderName
                              - required:
                                - httpCookie
                              - required:
                                - useSourceIp
                          required:
                          - consistentHash
                        properties:
                          consistentHash:
                            properties:
                              httpCookie:
                                description: Hash based on HTTP cookie.
                                properties:
                                  name:
                                    description: Name of the cookie.
                                    format: string
                                    type: string
                                  path:
                                    description: Path to set for the cookie.
                                    format: string
                                    type: string
                                  ttl:
                                    description: Lifetime of the cookie.
                                    type: string
                                type: object
                              httpHeaderName:
                                description: Hash based on a specific HTTP header.
                                format: string
                                type: string
                              minimumRingSize:
                                type: integer
                              useSourceIp:
                                description: Hash based on the source IP address.
                                type: boolean
                            type: object
                          localityLbSetting:
                            properties:
                              distribute:
                                description: 'Optional: only one of distribute or
                                  failover can be set.'
                                items:
                                  properties:
                                    from:
                                      description: Originating locality, '/' separated,
                                        e.g.
                                      format: string
                                      type: string
                                    to:
                                      additionalProperties:
                                        type: integer
                                      description: Map of upstream localities to traffic
                                        distribution weights.
                                      type: object
                                  type: object
                                type: array
                              enabled:
                                description: enable locality load balancing, this
                                  is DestinationRule-level and will override mesh
                                  wide settings in entirety.
                                type: boolean
                              failover:
                                description: 'Optional: only failover or distribute
                                  can be set.'
                                items:
                                  properties:
                                    from:
                                      description: Originating region.
                                      format: string
                                      type: string
                                    to:
                                      format: string
                                      type: string
                                  type: object
                                type: array
                            type: object
                          simple:
                            enum:
                            - ROUND_ROBIN
                            - LEAST_CONN
                            - RANDOM
                            - PASSTHROUGH
                            type: string
                        type: object
                      outlierDetection:
                        properties:
                          baseEjectionTime:
                            description: Minimum ejection duration.
                            type: string
                          consecutive5xxErrors:
                            description: Number of 5xx errors before a host is ejected
                              from the connection pool.
                            type: integer
                          consecutiveErrors:
                            format: int32
                            type: integer
                          consecutiveGatewayErrors:
                            description: Number of gateway errors before a host is
                              ejected from the connection pool.
                            type: integer
                          interval:
                            description: Time interval between ejection sweep analysis.
                            type: string
                          maxEjectionPercent:
                            format: int32
                            type: integer
                          minHealthPercent:
                            format: int32
                            type: integer
                        type: object
                      port:
                        properties:
                          number:
                            type: integer
                        type: object
                      tls:
                        description: TLS related settings for connections to the upstream
                          service.
                        properties:
                          caCertificates:
                            format: string
                            type: string
                          clientCertificate:
                            description: REQUIRED if mode is `+"`"+`MUTUAL`+"`"+`.
                            format: string
                            type: string
                          mode:
                            enum:
                            - DISABLE
                            - SIMPLE
                            - MUTUAL
                            - ISTIO_MUTUAL
                            type: string
                          privateKey:
                            description: REQUIRED if mode is `+"`"+`MUTUAL`+"`"+`.
                            format: string
                            type: string
                          sni:
                            description: SNI string to present to the server during
                              TLS handshake.
                            format: string
                            type: string
                          subjectAltNames:
                            items:
                              format: string
                              type: string
                            type: array
                        type: object
                    type: object
                  type: array
                tls:
                  description: TLS related settings for connections to the upstream
                    service.
                  properties:
                    caCertificates:
                      format: string
                      type: string
                    clientCertificate:
                      description: REQUIRED if mode is `+"`"+`MUTUAL`+"`"+`.
                      format: string
                      type: string
                    mode:
                      enum:
                      - DISABLE
                      - SIMPLE
                      - MUTUAL
                      - ISTIO_MUTUAL
                      type: string
                    privateKey:
                      description: REQUIRED if mode is `+"`"+`MUTUAL`+"`"+`.
                      format: string
                      type: string
                    sni:
                      description: SNI string to present to the server during TLS
                        handshake.
                      format: string
                      type: string
                    subjectAltNames:
                      items:
                        format: string
                        type: string
                      type: array
                  type: object
              type: object
          type: object
      type: object
  versions:
  - name: v1alpha3
    served: true
    storage: true
  - name: v1beta1
    served: true
    storage: false

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-pilot
    chart: istio
    heritage: Tiller
    release: istio
  name: envoyfilters.networking.istio.io
spec:
  group: networking.istio.io
  names:
    categories:
    - istio-io
    - networking-istio-io
    kind: EnvoyFilter
    listKind: EnvoyFilterList
    plural: envoyfilters
    singular: envoyfilter
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: 'Customizing Envoy configuration generated by Istio. See more
            details at: https://istio.io/docs/reference/config/networking/envoy-filter.html'
          properties:
            configPatches:
              description: One or more patches with match conditions.
              items:
                properties:
                  applyTo:
                    enum:
                    - INVALID
                    - LISTENER
                    - FILTER_CHAIN
                    - NETWORK_FILTER
                    - HTTP_FILTER
                    - ROUTE_CONFIGURATION
                    - VIRTUAL_HOST
                    - HTTP_ROUTE
                    - CLUSTER
                    type: string
                  match:
                    description: Match on listener/route configuration/cluster.
                    oneOf:
                    - not:
                        anyOf:
                        - required:
                          - listener
                        - required:
                          - routeConfiguration
                        - required:
                          - cluster
                    - required:
                      - listener
                    - required:
                      - routeConfiguration
                    - required:
                      - cluster
                    properties:
                      cluster:
                        description: Match on envoy cluster attributes.
                        properties:
                          name:
                            description: The exact name of the cluster to match.
                            format: string
                            type: string
                          portNumber:
                            description: The service port for which this cluster was
                              generated.
                            type: integer
                          service:
                            description: The fully qualified service name for this
                              cluster.
                            format: string
                            type: string
                          subset:
                            description: The subset associated with the service.
                            format: string
                            type: string
                        type: object
                      context:
                        description: The specific config generation context to match
                          on.
                        enum:
                        - ANY
                        - SIDECAR_INBOUND
                        - SIDECAR_OUTBOUND
                        - GATEWAY
                        type: string
                      listener:
                        description: Match on envoy listener attributes.
                        properties:
                          filterChain:
                            description: Match a specific filter chain in a listener.
                            properties:
                              applicationProtocols:
                                description: Applies only to sidecars.
                                format: string
                                type: string
                              filter:
                                description: The name of a specific filter to apply
                                  the patch to.
                                properties:
                                  name:
                                    description: The filter name to match on.
                                    format: string
                                    type: string
                                  subFilter:
                                    properties:
                                      name:
                                        description: The filter name to match on.
                                        format: string
                                        type: string
                                    type: object
                                type: object
                              name:
                                description: The name assigned to the filter chain.
                                format: string
                                type: string
                              sni:
                                description: The SNI value used by a filter chain's
                                  match condition.
                                format: string
                                type: string
                              transportProtocol:
                                description: Applies only to SIDECAR_INBOUND context.
                                format: string
                                type: string
                            type: object
                          name:
                            description: Match a specific listener by its name.
                            format: string
                            type: string
                          portName:
                            format: string
                            type: string
                          portNumber:
                            type: integer
                        type: object
                      proxy:
                        description: Match on properties associated with a proxy.
                        properties:
                          metadata:
                            additionalProperties:
                              format: string
                              type: string
                            type: object
                          proxyVersion:
                            format: string
                            type: string
                        type: object
                      routeConfiguration:
                        description: Match on envoy HTTP route configuration attributes.
                        properties:
                          gateway:
                            format: string
                            type: string
                          name:
                            description: Route configuration name to match on.
                            format: string
                            type: string
                          portName:
                            description: Applicable only for GATEWAY context.
                            format: string
                            type: string
                          portNumber:
                            type: integer
                          vhost:
                            properties:
                              name:
                                format: string
                                type: string
                              route:
                                description: Match a specific route within the virtual
                                  host.
                                properties:
                                  action:
                                    description: Match a route with specific action
                                      type.
                                    enum:
                                    - ANY
                                    - ROUTE
                                    - REDIRECT
                                    - DIRECT_RESPONSE
                                    type: string
                                  name:
                                    format: string
                                    type: string
                                type: object
                            type: object
                        type: object
                    type: object
                  patch:
                    description: The patch to apply along with the operation.
                    properties:
                      operation:
                        description: Determines how the patch should be applied.
                        enum:
                        - INVALID
                        - MERGE
                        - ADD
                        - REMOVE
                        - INSERT_BEFORE
                        - INSERT_AFTER
                        - INSERT_FIRST
                        type: string
                      value:
                        description: The JSON config of the object being patched.
                        type: object
                    type: object
                type: object
              type: array
            filters:
              items:
                properties:
                  filterConfig:
                    type: object
                  filterName:
                    description: The name of the filter to instantiate.
                    format: string
                    type: string
                  filterType:
                    description: The type of filter to instantiate.
                    enum:
                    - INVALID
                    - HTTP
                    - NETWORK
                    type: string
                  insertPosition:
                    description: Insert position in the filter chain.
                    properties:
                      index:
                        description: Position of this filter in the filter chain.
                        enum:
                        - FIRST
                        - LAST
                        - BEFORE
                        - AFTER
                        type: string
                      relativeTo:
                        format: string
                        type: string
                    type: object
                  listenerMatch:
                    properties:
                      address:
                        description: One or more IP addresses to which the listener
                          is bound.
                        items:
                          format: string
                          type: string
                        type: array
                      listenerProtocol:
                        description: Selects a class of listeners for the same protocol.
                        enum:
                        - ALL
                        - HTTP
                        - TCP
                        type: string
                      listenerType:
                        description: Inbound vs outbound sidecar listener or gateway
                          listener.
                        enum:
                        - ANY
                        - SIDECAR_INBOUND
                        - SIDECAR_OUTBOUND
                        - GATEWAY
                        type: string
                      portNamePrefix:
                        format: string
                        type: string
                      portNumber:
                        type: integer
                    type: object
                type: object
              type: array
            workloadLabels:
              additionalProperties:
                format: string
                type: string
              description: Deprecated.
              type: object
            workloadSelector:
              properties:
                labels:
                  additionalProperties:
                    format: string
                    type: string
                  type: object
              type: object
          type: object
      type: object
  versions:
  - name: v1alpha3
    served: true
    storage: true

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-pilot
    chart: istio
    heritage: Tiller
    release: istio
  name: gateways.networking.istio.io
spec:
  group: networking.istio.io
  names:
    categories:
    - istio-io
    - networking-istio-io
    kind: Gateway
    listKind: GatewayList
    plural: gateways
    shortNames:
    - gw
    singular: gateway
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: 'Configuration affecting edge load balancer. See more details
            at: https://istio.io/docs/reference/config/networking/gateway.html'
          properties:
            selector:
              additionalProperties:
                format: string
                type: string
              type: object
            servers:
              description: A list of server specifications.
              items:
                properties:
                  bind:
                    format: string
                    type: string
                  defaultEndpoint:
                    format: string
                    type: string
                  hosts:
                    description: One or more hosts exposed by this gateway.
                    items:
                      format: string
                      type: string
                    type: array
                  port:
                    properties:
                      name:
                        description: Label assigned to the port.
                        format: string
                        type: string
                      number:
                        description: A valid non-negative integer port number.
                        type: integer
                      protocol:
                        description: The protocol exposed on the port.
                        format: string
                        type: string
                    type: object
                  tls:
                    description: Set of TLS related options that govern the server's
                      behavior.
                    properties:
                      caCertificates:
                        description: REQUIRED if mode is `+"`"+`MUTUAL`+"`"+`.
                        format: string
                        type: string
                      cipherSuites:
                        description: 'Optional: If specified, only support the specified
                          cipher list.'
                        items:
                          format: string
                          type: string
                        type: array
                      credentialName:
                        format: string
                        type: string
                      httpsRedirect:
                        type: boolean
                      maxProtocolVersion:
                        description: 'Optional: Maximum TLS protocol version.'
                        enum:
                        - TLS_AUTO
                        - TLSV1_0
                        - TLSV1_1
                        - TLSV1_2
                        - TLSV1_3
                        type: string
                      minProtocolVersion:
                        description: 'Optional: Minimum TLS protocol version.'
                        enum:
                        - TLS_AUTO
                        - TLSV1_0
                        - TLSV1_1
                        - TLSV1_2
                        - TLSV1_3
                        type: string
                      mode:
                        enum:
                        - PASSTHROUGH
                        - SIMPLE
                        - MUTUAL
                        - AUTO_PASSTHROUGH
                        - ISTIO_MUTUAL
                        type: string
                      privateKey:
                        description: REQUIRED if mode is `+"`"+`SIMPLE`+"`"+` or `+"`"+`MUTUAL`+"`"+`.
                        format: string
                        type: string
                      serverCertificate:
                        description: REQUIRED if mode is `+"`"+`SIMPLE`+"`"+` or `+"`"+`MUTUAL`+"`"+`.
                        format: string
                        type: string
                      subjectAltNames:
                        items:
                          format: string
                          type: string
                        type: array
                      verifyCertificateHash:
                        items:
                          format: string
                          type: string
                        type: array
                      verifyCertificateSpki:
                        items:
                          format: string
                          type: string
                        type: array
                    type: object
                type: object
              type: array
          type: object
      type: object
  versions:
  - name: v1alpha3
    served: true
    storage: true
  - name: v1beta1
    served: true
    storage: false

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-pilot
    chart: istio
    heritage: Tiller
    release: istio
  name: serviceentries.networking.istio.io
spec:
  additionalPrinterColumns:
  - JSONPath: .spec.hosts
    description: The hosts associated with the ServiceEntry
    name: Hosts
    type: string
  - JSONPath: .spec.location
    description: Whether the service is external to the mesh or part of the mesh (MESH_EXTERNAL
      or MESH_INTERNAL)
    name: Location
    type: string
  - JSONPath: .spec.resolution
    description: Service discovery mode for the hosts (NONE, STATIC, or DNS)
    name: Resolution
    type: string
  - JSONPath: .metadata.creationTimestamp
    description: 'CreationTimestamp is a timestamp representing the server time when
      this object was created. It is not guaranteed to be set in happens-before order
      across separate operations. Clients may not set this value. It is represented
      in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
      lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
    name: Age
    type: date
  group: networking.istio.io
  names:
    categories:
    - istio-io
    - networking-istio-io
    kind: ServiceEntry
    listKind: ServiceEntryList
    plural: serviceentries
    shortNames:
    - se
    singular: serviceentry
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: 'Configuration affecting service registry. See more details
            at: https://istio.io/docs/reference/config/networking/service-entry.html'
          properties:
            addresses:
              description: The virtual IP addresses associated with the service.
              items:
                format: string
                type: string
              type: array
            endpoints:
              description: One or more endpoints associated with the service.
              items:
                properties:
                  address:
                    format: string
                    type: string
                  labels:
                    additionalProperties:
                      format: string
                      type: string
                    description: One or more labels associated with the endpoint.
                    type: object
                  locality:
                    description: The locality associated with the endpoint.
                    format: string
                    type: string
                  network:
                    format: string
                    type: string
                  ports:
                    additionalProperties:
                      type: integer
                    description: Set of ports associated with the endpoint.
                    type: object
                  weight:
                    description: The load balancing weight associated with the endpoint.
                    type: integer
                type: object
              type: array
            exportTo:
              description: A list of namespaces to which this service is exported.
              items:
                format: string
                type: string
              type: array
            hosts:
              description: The hosts associated with the ServiceEntry.
              items:
                format: string
                type: string
              type: array
            location:
              enum:
              - MESH_EXTERNAL
              - MESH_INTERNAL
              type: string
            ports:
              description: The ports associated with the external service.
              items:
                properties:
                  name:
                    description: Label assigned to the port.
                    format: string
                    type: string
                  number:
                    description: A valid non-negative integer port number.
                    type: integer
                  protocol:
                    description: The protocol exposed on the port.
                    format: string
                    type: string
                type: object
              type: array
            resolution:
              description: Service discovery mode for the hosts.
              enum:
              - NONE
              - STATIC
              - DNS
              type: string
            subjectAltNames:
              items:
                format: string
                type: string
              type: array
          type: object
      type: object
  versions:
  - name: v1alpha3
    served: true
    storage: true
  - name: v1beta1
    served: true
    storage: false

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-pilot
    chart: istio
    heritage: Tiller
    release: istio
  name: sidecars.networking.istio.io
spec:
  group: networking.istio.io
  names:
    categories:
    - istio-io
    - networking-istio-io
    kind: Sidecar
    listKind: SidecarList
    plural: sidecars
    singular: sidecar
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: 'Configuration affecting network reachability of a sidecar.
            See more details at: https://istio.io/docs/reference/config/networking/sidecar.html'
          properties:
            egress:
              items:
                properties:
                  bind:
                    format: string
                    type: string
                  captureMode:
                    enum:
                    - DEFAULT
                    - IPTABLES
                    - NONE
                    type: string
                  hosts:
                    items:
                      format: string
                      type: string
                    type: array
                  port:
                    description: The port associated with the listener.
                    properties:
                      name:
                        description: Label assigned to the port.
                        format: string
                        type: string
                      number:
                        description: A valid non-negative integer port number.
                        type: integer
                      protocol:
                        description: The protocol exposed on the port.
                        format: string
                        type: string
                    type: object
                type: object
              type: array
            ingress:
              items:
                properties:
                  bind:
                    description: The IP to which the listener should be bound.
                    format: string
                    type: string
                  captureMode:
                    enum:
                    - DEFAULT
                    - IPTABLES
                    - NONE
                    type: string
                  defaultEndpoint:
                    format: string
                    type: string
                  port:
                    description: The port associated with the listener.
                    properties:
                      name:
                        description: Label assigned to the port.
                        format: string
                        type: string
                      number:
                        description: A valid non-negative integer port number.
                        type: integer
                      protocol:
                        description: The protocol exposed on the port.
                        format: string
                        type: string
                    type: object
                type: object
              type: array
            outboundTrafficPolicy:
              description: This allows to configure the outbound traffic policy.
              properties:
                mode:
                  enum:
                  - REGISTRY_ONLY
                  - ALLOW_ANY
                  type: string
              type: object
            workloadSelector:
              properties:
                labels:
                  additionalProperties:
                    format: string
                    type: string
                  type: object
              type: object
          type: object
      type: object
  versions:
  - name: v1alpha3
    served: true
    storage: true
  - name: v1beta1
    served: true
    storage: false

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-pilot
    chart: istio
    heritage: Tiller
    release: istio
  name: virtualservices.networking.istio.io
spec:
  additionalPrinterColumns:
  - JSONPath: .spec.gateways
    description: The names of gateways and sidecars that should apply these routes
    name: Gateways
    type: string
  - JSONPath: .spec.hosts
    description: The destination hosts to which traffic is being sent
    name: Hosts
    type: string
  - JSONPath: .metadata.creationTimestamp
    description: 'CreationTimestamp is a timestamp representing the server time when
      this object was created. It is not guaranteed to be set in happens-before order
      across separate operations. Clients may not set this value. It is represented
      in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
      lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
    name: Age
    type: date
  group: networking.istio.io
  names:
    categories:
    - istio-io
    - networking-istio-io
    kind: VirtualService
    listKind: VirtualServiceList
    plural: virtualservices
    shortNames:
    - vs
    singular: virtualservice
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: 'Configuration affecting label/content routing, sni routing,
            etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html'
          properties:
            exportTo:
              description: A list of namespaces to which this virtual service is exported.
              items:
                format: string
                type: string
              type: array
            gateways:
              description: The names of gateways and sidecars that should apply these
                routes.
              items:
                format: string
                type: string
              type: array
            hosts:
              description: The destination hosts to which traffic is being sent.
              items:
                format: string
                type: string
              type: array
            http:
              description: An ordered list of route rules for HTTP traffic.
              items:
                properties:
                  corsPolicy:
                    description: Cross-Origin Resource Sharing policy (CORS).
                    properties:
                      allowCredentials:
                        type: boolean
                      allowHeaders:
                        items:
                          format: string
                          type: string
                        type: array
                      allowMethods:
                        description: List of HTTP methods allowed to access the resource.
                        items:
                          format: string
                          type: string
                        type: array
                      allowOrigin:
                        description: The list of origins that are allowed to perform
                          CORS requests.
                        items:
                          format: string
                          type: string
                        type: array
                      allowOrigins:
                        description: String patterns that match allowed origins.
                        items:
                          oneOf:
                          - not:
                              anyOf:
                              - required:
                                - exact
                              - required:
                                - prefix
                              - required:
                                - regex
                          - required:
                            - exact
                          - required:
                            - prefix
                          - required:
                            - regex
                          properties:
                            exact:
                              format: string
                              type: string
                            prefix:
                              format: string
                              type: string
                            regex:
                              format: string
                              type: string
                          type: object
                        type: array
                      exposeHeaders:
                        items:
                          format: string
                          type: string
                        type: array
                      maxAge:
                        type: string
                    type: object
                  fault:
                    description: Fault injection policy to apply on HTTP traffic at
                      the client side.
                    properties:
                      abort:
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - httpStatus
                            - required:
                              - grpcStatus
                            - required:
                              - http2Error
                        - required:
                          - httpStatus
                        - required:
                          - grpcStatus
                        - required:
                          - http2Error
                        properties:
                          grpcStatus:
                            format: string
                            type: string
                          http2Error:
                            format: string
                            type: string
                          httpStatus:
                            description: HTTP status code to use to abort the Http
                              request.
                            format: int32
                            type: integer
                          percentage:
                            description: Percentage of requests to be aborted with
                              the error code provided.
                            properties:
                              value:
                                format: double
                                type: number
                            type: object
                        type: object
                      delay:
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - fixedDelay
                            - required:
                              - exponentialDelay
                        - required:
                          - fixedDelay
                        - required:
                          - exponentialDelay
                        properties:
                          exponentialDelay:
                            type: string
                          fixedDelay:
                            description: Add a fixed delay before forwarding the request.
                            type: string
                          percent:
                            description: Percentage of requests on which the delay
                              will be injected (0-100).
                            format: int32
                            type: integer
                          percentage:
                            description: Percentage of requests on which the delay
                              will be injected.
                            properties:
                              value:
                                format: double
                                type: number
                            type: object
                        type: object
                    type: object
                  headers:
                    properties:
                      request:
                        properties:
                          add:
                            additionalProperties:
                              format: string
                              type: string
                            type: object
                          remove:
                            items:
                              format: string
                              type: string
                            type: array
                          set:
                            additionalProperties:
                              format: string
                              type: string
                            type: object
                        type: object
                      response:
                        properties:
                          add:
                            additionalProperties:
                              format: string
                              type: string
                            type: object
                          remove:
                            items:
                              format: string
                              type: string
                            type: array
                          set:
                            additionalProperties:
                              format: string
                              type: string
                            type: object
                        type: object
                    type: object
                  match:
                    items:
                      properties:
                        authority:
                          oneOf:
                          - not:
                              anyOf:
                              - required:
                                - exact
                              - required:
                                - prefix
                              - required:
                                - regex
                          - required:
                            - exact
                          - required:
                            - prefix
                          - required:
                            - regex
                          properties:
                            exact:
                              format: string
                              type: string
                            prefix:
                              format: string
                              type: string
                            regex:
                              format: string
                              type: string
                          type: object
                        gateways:
                          description: Names of gateways where the rule should be
                            applied.
                          items:
                            format: string
                            type: string
                          type: array
                        headers:
                          additionalProperties:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - regex
                            - required:
                              - exact
                            - required:
                              - prefix
                            - required:
                              - regex
                            properties:
                              exact:
                                format: string
                                type: string
                              prefix:
                                format: string
                                type: string
                              regex:
                                format: string
                                type: string
                            type: object
                          type: object
                        ignoreUriCase:
                          description: Flag to specify whether the URI matching should
                            be case-insensitive.
                          type: boolean
                        method:
                          oneOf:
                          - not:
                              anyOf:
                              - required:
                                - exact
                              - required:
                                - prefix
                              - required:
                                - regex
                          - required:
                            - exact
                          - required:
                            - prefix
                          - required:
                            - regex
                          properties:
                            exact:
                              format: string
                              type: string
                            prefix:
                              format: string
                              type: string
                            regex:
                              format: string
                              type: string
                          type: object
                        name:
                          description: The name assigned to a match.
                          format: string
                          type: string
                        port:
                          description: Specifies the ports on the host that is being
                            addressed.
                          type: integer
                        queryParams:
                          additionalProperties:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - regex
                            - required:
                              - exact
                            - required:
                              - prefix
                            - required:
                              - regex
                            properties:
                              exact:
                                format: string
                                type: string
                              prefix:
                                format: string
                                type: string
                              regex:
                                format: string
                                type: string
                            type: object
                          description: Query parameters for matching.
                          type: object
                        scheme:
                          oneOf:
                          - not:
                              anyOf:
                              - required:
                                - exact
                              - required:
                                - prefix
                              - required:
                                - regex
                          - required:
                            - exact
                          - required:
                            - prefix
                          - required:
                            - regex
                          properties:
                            exact:
                              format: string
                              type: string
                            prefix:
                              format: string
                              type: string
                            regex:
                              format: string
                              type: string
                          type: object
                        sourceLabels:
                          additionalProperties:
                            format: string
                            type: string
                          type: object
                        uri:
                          oneOf:
                          - not:
                              anyOf:
                              - required:
                                - exact
                              - required:
                                - prefix
                              - required:
                                - regex
                          - required:
                            - exact
                          - required:
                            - prefix
                          - required:
                            - regex
                          properties:
                            exact:
                              format: string
                              type: string
                            prefix:
                              format: string
                              type: string
                            regex:
                              format: string
                              type: string
                          type: object
                      type: object
                    type: array
                  mirror:
                    properties:
                      host:
                        description: The name of a service from the service registry.
                        format: string
                        type: string
                      port:
                        description: Specifies the port on the host that is being
                          addressed.
                        properties:
                          number:
                            type: integer
                        type: object
                      subset:
                        description: The name of a subset within the service.
                        format: string
                        type: string
                    type: object
                  mirror_percent:
                    description: Percentage of the traffic to be mirrored by the `+"`"+`mirror`+"`"+`
                      field.
                    type: integer
                  mirrorPercent:
                    description: Percentage of the traffic to be mirrored by the `+"`"+`mirror`+"`"+`
                      field.
                    type: integer
                  mirrorPercentage:
                    description: Percentage of the traffic to be mirrored by the `+"`"+`mirror`+"`"+`
                      field.
                    properties:
                      value:
                        format: double
                        type: number
                    type: object
                  name:
                    description: The name assigned to the route for debugging purposes.
                    format: string
                    type: string
                  redirect:
                    description: A HTTP rule can either redirect or forward (default)
                      traffic.
                    properties:
                      authority:
                        format: string
                        type: string
                      redirectCode:
                        type: integer
                      uri:
                        format: string
                        type: string
                    type: object
                  retries:
                    description: Retry policy for HTTP requests.
                    properties:
                      attempts:
                        description: Number of retries for a given request.
                        format: int32
                        type: integer
                      perTryTimeout:
                        description: Timeout per retry attempt for a given request.
                        type: string
                      retryOn:
                        description: Specifies the conditions under which retry takes
                          place.
                        format: string
                        type: string
                    type: object
                  rewrite:
                    description: Rewrite HTTP URIs and Authority headers.
                    properties:
                      authority:
                        description: rewrite the Authority/Host header with this value.
                        format: string
                        type: string
                      uri:
                        format: string
                        type: string
                    type: object
                  route:
                    description: A HTTP rule can either redirect or forward (default)
                      traffic.
                    items:
                      properties:
                        destination:
                          properties:
                            host:
                              description: The name of a service from the service
                                registry.
                              format: string
                              type: string
                            port:
                              description: Specifies the port on the host that is
                                being addressed.
                              properties:
                                number:
                                  type: integer
                              type: object
                            subset:
                              description: The name of a subset within the service.
                              format: string
                              type: string
                          type: object
                        headers:
                          properties:
                            request:
                              properties:
                                add:
                                  additionalProperties:
                                    format: string
                                    type: string
                                  type: object
                                remove:
                                  items:
                                    format: string
                                    type: string
                                  type: array
                                set:
                                  additionalProperties:
                                    format: string
                                    type: string
                                  type: object
                              type: object
                            response:
                              properties:
                                add:
                                  additionalProperties:
                                    format: string
                                    type: string
                                  type: object
                                remove:
                                  items:
                                    format: string
                                    type: string
                                  type: array
                                set:
                                  additionalProperties:
                                    format: string
                                    type: string
                                  type: object
                              type: object
                          type: object
                        weight:
                          format: int32
                          type: integer
                      type: object
                    type: array
                  timeout:
                    description: Timeout for HTTP requests.
                    type: string
                type: object
              type: array
            tcp:
              description: An ordered list of route rules for opaque TCP traffic.
              items:
                properties:
                  match:
                    items:
                      properties:
                        destinationSubnets:
                          description: IPv4 or IPv6 ip addresses of destination with
                            optional subnet.
                          items:
                            format: string
                            type: string
                          type: array
                        gateways:
                          description: Names of gateways where the rule should be
                            applied.
                          items:
                            format: string
                            type: string
                          type: array
                        port:
                          description: Specifies the port on the host that is being
                            addressed.
                          type: integer
                        sourceLabels:
                          additionalProperties:
                            format: string
                            type: string
                          type: object
                        sourceSubnet:
                          description: IPv4 or IPv6 ip address of source with optional
                            subnet.
                          format: string
                          type: string
                      type: object
                    type: array
                  route:
                    description: The destination to which the connection should be
                      forwarded to.
                    items:
                      properties:
                        destination:
                          properties:
                            host:
                              description: The name of a service from the service
                                registry.
                              format: string
                              type: string
                            port:
                              description: Specifies the port on the host that is
                                being addressed.
                              properties:
                                number:
                                  type: integer
                              type: object
                            subset:
                              description: The name of a subset within the service.
                              format: string
                              type: string
                          type: object
                        weight:
                          format: int32
                          type: integer
                      type: object
                    type: array
                type: object
              type: array
            tls:
              items:
                properties:
                  match:
                    items:
                      properties:
                        destinationSubnets:
                          description: IPv4 or IPv6 ip addresses of destination with
                            optional subnet.
                          items:
                            format: string
                            type: string
                          type: array
                        gateways:
                          description: Names of gateways where the rule should be
                            applied.
                          items:
                            format: string
                            type: string
                          type: array
                        port:
                          description: Specifies the port on the host that is being
                            addressed.
                          type: integer
                        sniHosts:
                          description: SNI (server name indicator) to match on.
                          items:
                            format: string
                            type: string
                          type: array
                        sourceLabels:
                          additionalProperties:
                            format: string
                            type: string
                          type: object
                      type: object
                    type: array
                  route:
                    description: The destination to which the connection should be
                      forwarded to.
                    items:
                      properties:
                        destination:
                          properties:
                            host:
                              description: The name of a service from the service
                                registry.
                              format: string
                              type: string
                            port:
                              description: Specifies the port on the host that is
                                being addressed.
                              properties:
                                number:
                                  type: integer
                              type: object
                            subset:
                              description: The name of a subset within the service.
                              format: string
                              type: string
                          type: object
                        weight:
                          format: int32
                          type: integer
                      type: object
                    type: array
                type: object
              type: array
          type: object
      type: object
  versions:
  - name: v1alpha3
    served: true
    storage: true
  - name: v1beta1
    served: true
    storage: false

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: mixer
    chart: istio
    heritage: Tiller
    istio: core
    package: istio.io.mixer
    release: istio
  name: attributemanifests.config.istio.io
spec:
  group: config.istio.io
  names:
    categories:
    - istio-io
    - policy-istio-io
    kind: attributemanifest
    listKind: attributemanifestList
    plural: attributemanifests
    singular: attributemanifest
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: 'Describes the rules used to configure Mixer''s policy and
            telemetry features. See more details at: https://istio.io/docs/reference/config/policy-and-telemetry/istio.policy.v1beta1.html'
          properties:
            attributes:
              additionalProperties:
                properties:
                  description:
                    description: A human-readable description of the attribute's purpose.
                    format: string
                    type: string
                  valueType:
                    description: The type of data carried by this attribute.
                    enum:
                    - VALUE_TYPE_UNSPECIFIED
                    - STRING
                    - INT64
                    - DOUBLE
                    - BOOL
                    - TIMESTAMP
                    - IP_ADDRESS
                    - EMAIL_ADDRESS
                    - URI
                    - DNS_NAME
                    - DURATION
                    - STRING_MAP
                    type: string
                type: object
              description: The set of attributes this Istio component will be responsible
                for producing at runtime.
              type: object
            name:
              description: Name of the component producing these attributes.
              format: string
              type: string
            revision:
              description: The revision of this document.
              format: string
              type: string
          type: object
      type: object
  versions:
  - name: v1alpha2
    served: true
    storage: true

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: mixer
    chart: istio
    heritage: Tiller
    istio: mixer-handler
    package: handler
    release: istio
  name: handlers.config.istio.io
spec:
  group: config.istio.io
  names:
    categories:
    - istio-io
    - policy-istio-io
    kind: handler
    listKind: handlerList
    plural: handlers
    singular: handler
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: Handler allows the operator to configure a specific adapter
            implementation.
          properties:
            adapter:
              description: The name of a specific adapter implementation.
              format: string
              type: string
            compiledAdapter:
              description: The name of the compiled in adapter this handler instantiates.
              format: string
              type: string
            connection:
              description: Information on how to connect to the out-of-process adapter.
              properties:
                address:
                  description: The address of the backend.
                  format: string
                  type: string
                authentication:
                  description: Auth config for the connection to the backend.
                  oneOf:
                  - not:
                      anyOf:
                      - properties:
                          tls:
                            allOf:
                            - oneOf:
                              - not:
                                  anyOf:
                                  - required:
                                    - tokenPath
                                  - required:
                                    - oauth
                              - required:
                                - tokenPath
                              - required:
                                - oauth
                            - oneOf:
                              - not:
                                  anyOf:
                                  - required:
                                    - authHeader
                                  - required:
                                    - customHeader
                              - required:
                                - authHeader
                              - required:
                                - customHeader
                        required:
                        - tls
                      - required:
                        - mutual
                  - properties:
                      tls:
                        allOf:
                        - oneOf:
                          - not:
                              anyOf:
                              - required:
                                - tokenPath
                              - required:
                                - oauth
                          - required:
                            - tokenPath
                          - required:
                            - oauth
                        - oneOf:
                          - not:
                              anyOf:
                              - required:
                                - authHeader
                              - required:
                                - customHeader
                          - required:
                            - authHeader
                          - required:
                            - customHeader
                    required:
                    - tls
                  - required:
                    - mutual
                  properties:
                    mutual:
                      properties:
                        caCertificates:
                          format: string
                          type: string
                        clientCertificate:
                          description: The path to the file holding client certificate
                            for mutual TLS.
                          format: string
                          type: string
                        privateKey:
                          description: The path to the file holding the private key
                            for mutual TLS.
                          format: string
                          type: string
                        serverName:
                          description: Used to configure mixer mutual TLS client to
                            supply server name for SNI.
                          format: string
                          type: string
                      type: object
                    tls:
                      properties:
                        authHeader:
                          description: Access token is passed as authorization header.
                          enum:
                          - PLAIN
                          - BEARER
                          type: string
                        caCertificates:
                          format: string
                          type: string
                        customHeader:
                          description: Customized header key to hold access token,
                            e.g.
                          format: string
                          type: string
                        oauth:
                          description: Oauth config to fetch access token from auth
                            provider.
                          properties:
                            clientId:
                              description: OAuth client id for mixer.
                              format: string
                              type: string
                            clientSecret:
                              description: The path to the file holding the client
                                secret for oauth.
                              format: string
                              type: string
                            endpointParams:
                              additionalProperties:
                                format: string
                                type: string
                              description: Additional parameters for requests to the
                                token endpoint.
                              type: object
                            scopes:
                              description: List of requested permissions.
                              items:
                                format: string
                                type: string
                              type: array
                            tokenUrl:
                              description: The Resource server's token endpoint URL.
                              format: string
                              type: string
                          type: object
                        serverName:
                          format: string
                          type: string
                        tokenPath:
                          format: string
                          type: string
                      type: object
                  type: object
                timeout:
                  description: Timeout for remote calls to the backend.
                  type: string
              type: object
            name:
              description: Must be unique in the entire Mixer configuration.
              format: string
              type: string
            params:
              description: Depends on adapter implementation.
              type: object
          type: object
      type: object
  versions:
  - name: v1alpha2
    served: true
    storage: true

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: mixer
    chart: istio
    heritage: Tiller
    istio: mixer-instance
    package: instance
    release: istio
  name: instances.config.istio.io
spec:
  group: config.istio.io
  names:
    categories:
    - istio-io
    - policy-istio-io
    kind: instance
    listKind: instanceList
    plural: instances
    singular: instance
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: An Instance tells Mixer how to create instances for particular
            template.
          properties:
            attributeBindings:
              additionalProperties:
                format: string
                type: string
              type: object
            compiledTemplate:
              description: The name of the compiled in template this instance creates
                instances for.
              format: string
              type: string
            name:
              format: string
              type: string
            params:
              description: Depends on referenced template.
              type: object
            template:
              description: The name of the template this instance creates instances
                for.
              format: string
              type: string
          type: object
      type: object
  versions:
  - name: v1alpha2
    served: true
    storage: true

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: mixer
    chart: istio
    heritage: Tiller
    istio: core
    package: istio.io.mixer
    release: istio
  name: rules.config.istio.io
spec:
  group: config.istio.io
  names:
    categories:
    - istio-io
    - policy-istio-io
    kind: rule
    listKind: ruleList
    plural: rules
    singular: rule
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: 'Describes the rules used to configure Mixer''s policy and
            telemetry features. See more details at: https://istio.io/docs/reference/config/policy-and-telemetry/istio.policy.v1beta1.html'
          properties:
            actions:
              description: The actions that will be executed when match evaluates
                to `+"`"+`true`+"`"+`.
              items:
                properties:
                  handler:
                    description: Fully qualified name of the handler to invoke.
                    format: string
                    type: string
                  instances:
                    items:
                      format: string
                      type: string
                    type: array
                  name:
                    description: A handle to refer to the results of the action.
                    format: string
                    type: string
                type: object
              type: array
            match:
              description: Match is an attribute based predicate.
              format: string
              type: string
            requestHeaderOperations:
              items:
                properties:
                  name:
                    description: Header name literal value.
                    format: string
                    type: string
                  operation:
                    description: Header operation type.
                    enum:
                    - REPLACE
                    - REMOVE
                    - APPEND
                    type: string
                  values:
                    description: Header value expressions.
                    items:
                      format: string
                      type: string
                    type: array
                type: object
              type: array
            responseHeaderOperations:
              items:
                properties:
                  name:
                    description: Header name literal value.
                    format: string
                    type: string
                  operation:
                    description: Header operation type.
                    enum:
                    - REPLACE
                    - REMOVE
                    - APPEND
                    type: string
                  values:
                    description: Header value expressions.
                    items:
                      format: string
                      type: string
                    type: array
                type: object
              type: array
            sampling:
              properties:
                random:
                  description: Provides filtering of actions based on random selection
                    per request.
                  properties:
                    attributeExpression:
                      description: Specifies an attribute expression to use to override
                        the numerator in the `+"`"+`percent_sampled`+"`"+` field.
                      format: string
                      type: string
                    percentSampled:
                      description: The default sampling rate, expressed as a percentage.
                      properties:
                        denominator:
                          description: Specifies the denominator.
                          enum:
                          - HUNDRED
                          - TEN_THOUSAND
                          type: string
                        numerator:
                          description: Specifies the numerator.
                          type: integer
                      type: object
                    useIndependentRandomness:
                      description: By default sampling will be based on the value
                        of the request header `+"`"+`x-request-id`+"`"+`.
                      type: boolean
                  type: object
                rateLimit:
                  properties:
                    maxUnsampledEntries:
                      description: Number of entries to allow during the `+"`"+`sampling_duration`+"`"+`
                        before sampling is enforced.
                      format: int64
                      type: integer
                    samplingDuration:
                      description: Window in which to enforce the sampling rate.
                      type: string
                    samplingRate:
                      description: The rate at which to sample entries once the unsampled
                        limit has been reached.
                      format: int64
                      type: integer
                  type: object
              type: object
          type: object
      type: object
  versions:
  - name: v1alpha2
    served: true
    storage: true

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-pilot
    chart: istio
    heritage: Tiller
    istio: rbac
    release: istio
  name: clusterrbacconfigs.rbac.istio.io
spec:
  group: rbac.istio.io
  names:
    categories:
    - istio-io
    - rbac-istio-io
    kind: ClusterRbacConfig
    listKind: ClusterRbacConfigList
    plural: clusterrbacconfigs
    singular: clusterrbacconfig
  scope: Cluster
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: 'Configuration for Role Based Access Control. See more details
            at: https://istio.io/docs/reference/config/security/istio.rbac.v1alpha1.html'
          properties:
            enforcementMode:
              enum:
              - ENFORCED
              - PERMISSIVE
              type: string
            exclusion:
              description: A list of services or namespaces that should not be enforced
                by Istio RBAC policies.
              properties:
                namespaces:
                  description: A list of namespaces.
                  items:
                    format: string
                    type: string
                  type: array
                services:
                  description: A list of services.
                  items:
                    format: string
                    type: string
                  type: array
              type: object
            inclusion:
              description: A list of services or namespaces that should be enforced
                by Istio RBAC policies.
              properties:
                namespaces:
                  description: A list of namespaces.
                  items:
                    format: string
                    type: string
                  type: array
                services:
                  description: A list of services.
                  items:
                    format: string
                    type: string
                  type: array
              type: object
            mode:
              description: Istio RBAC mode.
              enum:
              - "OFF"
              - "ON"
              - ON_WITH_INCLUSION
              - ON_WITH_EXCLUSION
              type: string
          type: object
      type: object
  versions:
  - name: v1alpha1
    served: true
    storage: true

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: mixer
    chart: istio
    heritage: Tiller
    istio: rbac
    package: istio.io.mixer
    release: istio
  name: rbacconfigs.rbac.istio.io
spec:
  group: rbac.istio.io
  names:
    categories:
    - istio-io
    - rbac-istio-io
    kind: RbacConfig
    listKind: RbacConfigList
    plural: rbacconfigs
    singular: rbacconfig
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: 'Configuration for Role Based Access Control. See more details
            at: https://istio.io/docs/reference/config/security/istio.rbac.v1alpha1.html'
          properties:
            enforcementMode:
              enum:
              - ENFORCED
              - PERMISSIVE
              type: string
            exclusion:
              description: A list of services or namespaces that should not be enforced
                by Istio RBAC policies.
              properties:
                namespaces:
                  description: A list of namespaces.
                  items:
                    format: string
                    type: string
                  type: array
                services:
                  description: A list of services.
                  items:
                    format: string
                    type: string
                  type: array
              type: object
            inclusion:
              description: A list of services or namespaces that should be enforced
                by Istio RBAC policies.
              properties:
                namespaces:
                  description: A list of namespaces.
                  items:
                    format: string
                    type: string
                  type: array
                services:
                  description: A list of services.
                  items:
                    format: string
                    type: string
                  type: array
              type: object
            mode:
              description: Istio RBAC mode.
              enum:
              - "OFF"
              - "ON"
              - ON_WITH_INCLUSION
              - ON_WITH_EXCLUSION
              type: string
          type: object
      type: object
  versions:
  - name: v1alpha1
    served: true
    storage: true

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: mixer
    chart: istio
    heritage: Tiller
    istio: rbac
    package: istio.io.mixer
    release: istio
  name: serviceroles.rbac.istio.io
spec:
  group: rbac.istio.io
  names:
    categories:
    - istio-io
    - rbac-istio-io
    kind: ServiceRole
    listKind: ServiceRoleList
    plural: serviceroles
    singular: servicerole
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: 'Configuration for Role Based Access Control. See more details
            at: https://istio.io/docs/reference/config/security/istio.rbac.v1alpha1.html'
          properties:
            rules:
              description: The set of access rules (permissions) that the role has.
              items:
                properties:
                  constraints:
                    description: Optional.
                    items:
                      properties:
                        key:
                          description: Key of the constraint.
                          format: string
                          type: string
                        values:
                          description: List of valid values for the constraint.
                          items:
                            format: string
                            type: string
                          type: array
                      type: object
                    type: array
                  hosts:
                    items:
                      format: string
                      type: string
                    type: array
                  methods:
                    description: Optional.
                    items:
                      format: string
                      type: string
                    type: array
                  notHosts:
                    items:
                      format: string
                      type: string
                    type: array
                  notMethods:
                    items:
                      format: string
                      type: string
                    type: array
                  notPaths:
                    items:
                      format: string
                      type: string
                    type: array
                  notPorts:
                    items:
                      format: int32
                      type: integer
                    type: array
                  paths:
                    description: Optional.
                    items:
                      format: string
                      type: string
                    type: array
                  ports:
                    items:
                      format: int32
                      type: integer
                    type: array
                  services:
                    description: A list of service names.
                    items:
                      format: string
                      type: string
                    type: array
                type: object
              type: array
          type: object
      type: object
  versions:
  - name: v1alpha1
    served: true
    storage: true

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: mixer
    chart: istio
    heritage: Tiller
    istio: rbac
    package: istio.io.mixer
    release: istio
  name: servicerolebindings.rbac.istio.io
spec:
  additionalPrinterColumns:
  - JSONPath: .spec.roleRef.name
    description: The name of the ServiceRole object being referenced
    name: Reference
    type: string
  - JSONPath: .metadata.creationTimestamp
    description: 'CreationTimestamp is a timestamp representing the server time when
      this object was created. It is not guaranteed to be set in happens-before order
      across separate operations. Clients may not set this value. It is represented
      in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
      lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
    name: Age
    type: date
  group: rbac.istio.io
  names:
    categories:
    - istio-io
    - rbac-istio-io
    kind: ServiceRoleBinding
    listKind: ServiceRoleBindingList
    plural: servicerolebindings
    singular: servicerolebinding
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: 'Configuration for Role Based Access Control. See more details
            at: https://istio.io/docs/reference/config/security/istio.rbac.v1alpha1.html'
          properties:
            actions:
              items:
                properties:
                  constraints:
                    description: Optional.
                    items:
                      properties:
                        key:
                          description: Key of the constraint.
                          format: string
                          type: string
                        values:
                          description: List of valid values for the constraint.
                          items:
                            format: string
                            type: string
                          type: array
                      type: object
                    type: array
                  hosts:
                    items:
                      format: string
                      type: string
                    type: array
                  methods:
                    description: Optional.
                    items:
                      format: string
                      type: string
                    type: array
                  notHosts:
                    items:
                      format: string
                      type: string
                    type: array
                  notMethods:
                    items:
                      format: string
                      type: string
                    type: array
                  notPaths:
                    items:
                      format: string
                      type: string
                    type: array
                  notPorts:
                    items:
                      format: int32
                      type: integer
                    type: array
                  paths:
                    description: Optional.
                    items:
                      format: string
                      type: string
                    type: array
                  ports:
                    items:
                      format: int32
                      type: integer
                    type: array
                  services:
                    description: A list of service names.
                    items:
                      format: string
                      type: string
                    type: array
                type: object
              type: array
            mode:
              enum:
              - ENFORCED
              - PERMISSIVE
              type: string
            role:
              format: string
              type: string
            roleRef:
              description: Reference to the ServiceRole object.
              properties:
                kind:
                  description: The type of the role being referenced.
                  format: string
                  type: string
                name:
                  description: The name of the ServiceRole object being referenced.
                  format: string
                  type: string
              type: object
            subjects:
              description: List of subjects that are assigned the ServiceRole object.
              items:
                properties:
                  group:
                    format: string
                    type: string
                  groups:
                    items:
                      format: string
                      type: string
                    type: array
                  ips:
                    items:
                      format: string
                      type: string
                    type: array
                  names:
                    items:
                      format: string
                      type: string
                    type: array
                  namespaces:
                    items:
                      format: string
                      type: string
                    type: array
                  notGroups:
                    items:
                      format: string
                      type: string
                    type: array
                  notIps:
                    items:
                      format: string
                      type: string
                    type: array
                  notNames:
                    items:
                      format: string
                      type: string
                    type: array
                  notNamespaces:
                    items:
                      format: string
                      type: string
                    type: array
                  properties:
                    additionalProperties:
                      format: string
                      type: string
                    description: Optional.
                    type: object
                  user:
                    description: Optional.
                    format: string
                    type: string
                type: object
              type: array
          type: object
      type: object
  versions:
  - name: v1alpha1
    served: true
    storage: true

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-pilot
    chart: istio
    heritage: Tiller
    istio: security
    release: istio
  name: authorizationpolicies.security.istio.io
spec:
  group: security.istio.io
  names:
    categories:
    - istio-io
    - security-istio-io
    kind: AuthorizationPolicy
    listKind: AuthorizationPolicyList
    plural: authorizationpolicies
    singular: authorizationpolicy
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: 'Configuration for access control on workloads. See more details
            at: https://istio.io/docs/reference/config/security/authorization-policy.html'
          properties:
            action:
              description: Optional.
              enum:
              - ALLOW
              - DENY
              type: string
            rules:
              description: Optional.
              items:
                properties:
                  from:
                    description: Optional.
                    items:
                      properties:
                        source:
                          description: Source specifies the source of a request.
                          properties:
                            ipBlocks:
                              description: Optional.
                              items:
                                format: string
                                type: string
                              type: array
                            namespaces:
                              description: Optional.
                              items:
                                format: string
                                type: string
                              type: array
                            notIpBlocks:
                              description: Optional.
                              items:
                                format: string
                                type: string
                              type: array
                            notNamespaces:
                              description: Optional.
                              items:
                                format: string
                                type: string
                              type: array
                            notPrincipals:
                              description: Optional.
                              items:
                                format: string
                                type: string
                              type: array
                            notRequestPrincipals:
                              description: Optional.
                              items:
                                format: string
                                type: string
                              type: array
                            principals:
                              description: Optional.
                              items:
                                format: string
                                type: string
                              type: array
                            requestPrincipals:
                              description: Optional.
                              items:
                                format: string
                                type: string
                              type: array
                          type: object
                      type: object
                    type: array
                  to:
                    description: Optional.
                    items:
                      properties:
                        operation:
                          description: Operation specifies the operation of a request.
                          properties:
                            hosts:
                              description: Optional.
                              items:
                                format: string
                                type: string
                              type: array
                            methods:
                              description: Optional.
                              items:
                                format: string
                                type: string
                              type: array
                            notHosts:
                              description: Optional.
                              items:
                                format: string
                                type: string
                              type: array
                            notMethods:
                              description: Optional.
                              items:
                                format: string
                                type: string
                              type: array
                            notPaths:
                              description: Optional.
                              items:
                                format: string
                                type: string
                              type: array
                            notPorts:
                              description: Optional.
                              items:
                                format: string
                                type: string
                              type: array
                            paths:
                              description: Optional.
                              items:
                                format: string
                                type: string
                              type: array
                            ports:
                              description: Optional.
                              items:
                                format: string
                                type: string
                              type: array
                          type: object
                      type: object
                    type: array
                  when:
                    description: Optional.
                    items:
                      properties:
                        key:
                          description: The name of an Istio attribute.
                          format: string
                          type: string
                        notValues:
                          description: Optional.
                          items:
                            format: string
                            type: string
                          type: array
                        values:
                          description: Optional.
                          items:
                            format: string
                            type: string
                          type: array
                      type: object
                    type: array
                type: object
              type: array
            selector:
              description: Optional.
              properties:
                matchLabels:
                  additionalProperties:
                    format: string
                    type: string
                  type: object
              type: object
          type: object
      type: object
  versions:
  - name: v1beta1
    served: true
    storage: true

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-pilot
    chart: istio
    heritage: Tiller
    istio: security
    release: istio
  name: peerauthentications.security.istio.io
spec:
  group: security.istio.io
  names:
    categories:
    - istio-io
    - security-istio-io
    kind: PeerAuthentication
    listKind: PeerAuthenticationList
    plural: peerauthentications
    singular: peerauthentication
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: PeerAuthentication defines how traffic will be tunneled (or
            not) to the sidecar.
          properties:
            mtls:
              description: Mutual TLS settings for workload.
              properties:
                mode:
                  description: Defines the mTLS mode used for peer authentication.
                  enum:
                  - UNSET
                  - DISABLE
                  - PERMISSIVE
                  - STRICT
                  type: string
              type: object
            portLevelMtls:
              additionalProperties:
                properties:
                  mode:
                    description: Defines the mTLS mode used for peer authentication.
                    enum:
                    - UNSET
                    - DISABLE
                    - PERMISSIVE
                    - STRICT
                    type: string
                type: object
              description: Port specific mutual TLS settings.
              type: object
            selector:
              description: The selector determines the workloads to apply the ChannelAuthentication
                on.
              properties:
                matchLabels:
                  additionalProperties:
                    format: string
                    type: string
                  type: object
              type: object
          type: object
      type: object
  versions:
  - name: v1beta1
    served: true
    storage: true

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-pilot
    chart: istio
    heritage: Tiller
    istio: security
    release: istio
  name: requestauthentications.security.istio.io
spec:
  group: security.istio.io
  names:
    categories:
    - istio-io
    - security-istio-io
    kind: RequestAuthentication
    listKind: RequestAuthenticationList
    plural: requestauthentications
    singular: requestauthentication
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        spec:
          description: RequestAuthentication defines what request authentication methods
            are supported by a workload.
          properties:
            jwtRules:
              description: Define the list of JWTs that can be validated at the selected
                workloads' proxy.
              items:
                properties:
                  audiences:
                    items:
                      format: string
                      type: string
                    type: array
                  forwardOriginalToken:
                    description: If set to true, the orginal token will be kept for
                      the ustream request.
                    type: boolean
                  fromHeaders:
                    description: List of header locations from which JWT is expected.
                    items:
                      properties:
                        name:
                          description: The HTTP header name.
                          format: string
                          type: string
                        prefix:
                          description: The prefix that should be stripped before decoding
                            the token.
                          format: string
                          type: string
                      type: object
                    type: array
                  fromParams:
                    description: List of query parameters from which JWT is expected.
                    items:
                      format: string
                      type: string
                    type: array
                  issuer:
                    description: Identifies the issuer that issued the JWT.
                    format: string
                    type: string
                  jwks:
                    description: JSON Web Key Set of public keys to validate signature
                      of the JWT.
                    format: string
                    type: string
                  jwks_uri:
                    format: string
                    type: string
                  jwksUri:
                    format: string
                    type: string
                  outputPayloadToHeader:
                    format: string
                    type: string
                type: object
              type: array
            selector:
              description: The selector determines the workloads to apply the RequestAuthentication
                on.
              properties:
                matchLabels:
                  additionalProperties:
                    format: string
                    type: string
                  type: object
              type: object
          type: object
      type: object
  versions:
  - name: v1beta1
    served: true
    storage: true

---
`)

func chartsBaseFilesCrdAllGenYamlBytes() ([]byte, error) {
	return _chartsBaseFilesCrdAllGenYaml, nil
}

func chartsBaseFilesCrdAllGenYaml() (*asset, error) {
	bytes, err := chartsBaseFilesCrdAllGenYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/base/files/crd-all.gen.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsBaseFilesCrdMixerYaml = []byte(`kind: CustomResourceDefinition
apiVersion: apiextensions.k8s.io/v1beta1
metadata:
  name: adapters.config.istio.io
  labels:
    app: mixer
    package: adapter
    istio: mixer-adapter
    chart: istio
    heritage: Tiller
    release: istio
  annotations:
    "helm.sh/resource-policy": keep
spec:
  group: config.istio.io
  names:
    kind: adapter
    plural: adapters
    singular: adapter
    categories:
    - istio-io
    - policy-istio-io
  scope: Namespaced
  subresources:
    status: {}
  versions:
    - name: v1alpha2
      served: true
      storage: true
---
kind: CustomResourceDefinition
apiVersion: apiextensions.k8s.io/v1beta1
metadata:
  name: templates.config.istio.io
  labels:
    app: mixer
    package: template
    istio: mixer-template
    chart: istio
    heritage: Tiller
    release: istio
  annotations:
    "helm.sh/resource-policy": keep
spec:
  group: config.istio.io
  names:
    kind: template
    plural: templates
    singular: template
    categories:
    - istio-io
    - policy-istio-io
  scope: Namespaced
  subresources:
    status: {}
  versions:
    - name: v1alpha2
      served: true
      storage: true
---
`)

func chartsBaseFilesCrdMixerYamlBytes() ([]byte, error) {
	return _chartsBaseFilesCrdMixerYaml, nil
}

func chartsBaseFilesCrdMixerYaml() (*asset, error) {
	bytes, err := chartsBaseFilesCrdMixerYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/base/files/crd-mixer.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsBaseKustomizationYaml = []byte(`apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - files/crd-all.gen.yaml
  - files/crd-mixer.yaml
`)

func chartsBaseKustomizationYamlBytes() ([]byte, error) {
	return _chartsBaseKustomizationYaml, nil
}

func chartsBaseKustomizationYaml() (*asset, error) {
	bytes, err := chartsBaseKustomizationYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/base/kustomization.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsBaseTemplatesClusterroleYaml = []byte(`{{ if .Values.clusterResources }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-reader-{{ .Release.Namespace }}
  labels:
    app: istio-reader
    release: {{ .Release.Name }}
rules:
- apiGroups:
  - "config.istio.io"
  - "rbac.istio.io"
  - "security.istio.io"
  - "networking.istio.io"
  - "authentication.istio.io"
  resources: ["*"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
  resources: ["replicasets"]
  verbs: ["get", "list", "watch"]
---
{{ end }}`)

func chartsBaseTemplatesClusterroleYamlBytes() ([]byte, error) {
	return _chartsBaseTemplatesClusterroleYaml, nil
}

func chartsBaseTemplatesClusterroleYaml() (*asset, error) {
	bytes, err := chartsBaseTemplatesClusterroleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/base/templates/clusterrole.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsBaseTemplatesClusterrolebindingYaml = []byte(`{{ if .Values.clusterResources }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-reader-{{ .Release.Namespace }}
  labels:
    app: istio-reader
    release: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istio-reader-{{ .Release.Namespace }}
subjects:
  - kind: ServiceAccount
    name: istio-reader-service-account
    namespace: {{ .Release.Namespace }}
---
{{ end }}
`)

func chartsBaseTemplatesClusterrolebindingYamlBytes() ([]byte, error) {
	return _chartsBaseTemplatesClusterrolebindingYaml, nil
}

func chartsBaseTemplatesClusterrolebindingYaml() (*asset, error) {
	bytes, err := chartsBaseTemplatesClusterrolebindingYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/base/templates/clusterrolebinding.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsBaseTemplatesCrdsYaml = []byte(`{{ .Files.Get "files/crd-all.gen.yaml" }}
{{ .Files.Get "files/crd-mixer.yaml" }}
`)

func chartsBaseTemplatesCrdsYamlBytes() ([]byte, error) {
	return _chartsBaseTemplatesCrdsYaml, nil
}

func chartsBaseTemplatesCrdsYaml() (*asset, error) {
	bytes, err := chartsBaseTemplatesCrdsYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/base/templates/crds.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsBaseTemplatesEndpointsYaml = []byte(`{{- if .Values.global.remotePilotAddress }}
  {{- if not .Values.global.istiod.enabled }}
apiVersion: v1
kind: Endpoints
metadata:
  name: istio-pilot
  namespace: {{ .Release.Namespace }}
subsets:
- addresses:
  - ip: {{ .Values.global.remotePilotAddress }}
  ports:
  - port: 15010
    name: grpc-xds # direct
  - port: 15011
    name: https-xds # mTLS or non-mTLS depending on auth setting
  - port: 8080
    name: http-legacy-discovery # direct
  - port: 15012
    name: tcp-istiod
  - port: 15014
    name: http-monitoring
  {{- else }}
apiVersion: v1
kind: Endpoints
metadata:
  name: istiod-remote
  namespace: {{ .Release.Namespace }}
subsets:
- addresses:
  - ip: {{ .Values.global.remotePilotAddress }}
  ports:
  - port: 15012
    name: tcp-istiod
  {{- end }}
---
{{- end }}
{{- if and .Values.global.remotePolicyAddress .Values.global.createRemoteSvcEndpoints }}
apiVersion: v1
kind: Endpoints
metadata:
  name: istio-policy
  namespace: {{ .Release.Namespace }}
subsets:
- addresses:
  - ip: {{ .Values.global.remotePolicyAddress }}
  ports:
  - name: grpc-mixer
    port: 9091
  - name: grpc-mixer-mtls
    port: 15004
  - name: http-monitoring
    port: 15014
{{- end }}
{{- if and .Values.global.remoteTelemetryAddress .Values.global.createRemoteSvcEndpoints }}
---
apiVersion: v1
kind: Endpoints
metadata:
  name: istio-telemetry
  namespace: {{ .Release.Namespace }}
subsets:
- addresses:
  - ip: {{ .Values.global.remoteTelemetryAddress }}
  ports:
  - name: grpc-mixer
    port: 9091
  - name: grpc-mixer-mtls
    port: 15004
  - name: http-monitoring
    port: 15014
  - name: prometheus
    port: 42422
{{- end }}
`)

func chartsBaseTemplatesEndpointsYamlBytes() ([]byte, error) {
	return _chartsBaseTemplatesEndpointsYaml, nil
}

func chartsBaseTemplatesEndpointsYaml() (*asset, error) {
	bytes, err := chartsBaseTemplatesEndpointsYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/base/templates/endpoints.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsBaseTemplatesNamespacesYaml = []byte(`# To prevent accidental injection into istio control plane namespaces.
apiVersion: v1
kind: Namespace
metadata:
  name: {{ .Release.Namespace }}
  labels:
    istio-operator-managed: Reconcile
    istio-injection: disabled
---

{{- if ne .Values.global.istioNamespace .Release.Namespace }}
apiVersion: v1
kind: Namespace
metadata:
  name: {{ .Values.global.istioNamespace }}
  labels:
    istio-operator-managed: Reconcile
    istio-injection: disabled
---
{{- end }}

{{- if and (ne .Values.global.configNamespace .Release.Namespace) (ne .Values.global.configNamespace .Values.global.istioNamespace) }}
apiVersion: v1
kind: Namespace
metadata:
  name: {{ .Values.global.configNamespace }}
  labels:
    istio-operator-managed: Reconcile
    istio-injection: disabled
---
{{- end }}

{{- if ne .Values.global.telemetryNamespace .Release.Namespace }}
apiVersion: v1
kind: Namespace
metadata:
  name: {{ .Values.global.telemetryNamespace }}
  labels:
    istio-operator-managed: Reconcile
    istio-injection: disabled
---
{{- end }}

{{- if and (ne .Values.global.prometheusNamespace .Release.Namespace) (ne .Values.global.prometheusNamespace .Values.global.telemetryNamespace) }}
apiVersion: v1
kind: Namespace
metadata:
  name: {{ .Values.global.prometheusNamespace }}
  labels:
    istio-operator-managed: Reconcile
    istio-injection: disabled
---
{{- end }}

{{- if ne .Values.global.policyNamespace .Release.Namespace }}
apiVersion: v1
kind: Namespace
metadata:
  name: {{ .Values.global.policyNamespace }}
  labels:
    istio-operator-managed: Reconcile
    istio-injection: disabled
---
{{- end }}
`)

func chartsBaseTemplatesNamespacesYamlBytes() ([]byte, error) {
	return _chartsBaseTemplatesNamespacesYaml, nil
}

func chartsBaseTemplatesNamespacesYaml() (*asset, error) {
	bytes, err := chartsBaseTemplatesNamespacesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/base/templates/namespaces.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsBaseTemplatesServiceaccountYaml = []byte(`{{ if .Values.clusterResources }}
apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end }}
metadata:
  name: istio-reader-service-account
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-reader
    release: {{ .Release.Name }}
---
{{ end }}
`)

func chartsBaseTemplatesServiceaccountYamlBytes() ([]byte, error) {
	return _chartsBaseTemplatesServiceaccountYaml, nil
}

func chartsBaseTemplatesServiceaccountYaml() (*asset, error) {
	bytes, err := chartsBaseTemplatesServiceaccountYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/base/templates/serviceaccount.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsBaseTemplatesServicesYaml = []byte(`{{- if .Values.global.remotePilotAddress }}
  {{- if not .Values.global.istiod.enabled }}
apiVersion: v1
kind: Service
metadata:
  name: istio-pilot
  namespace: {{ .Release.Namespace }}
spec:
  ports:
  - port: 15010
    name: grpc-xds # direct
  - port: 15011
    name: https-xds # mTLS or non-mTLS depending on auth setting
  - port: 8080
    name: http-legacy-discovery # direct
  - port: 15012
    name: tcp-istiod
  - port: 15014
    name: http-monitoring
  clusterIP: None
  {{- else }}
apiVersion: v1
kind: Service
metadata:
  name: istiod-remote
  namespace: {{ .Release.Namespace }}
spec:
  ports:
  - port: 15012
    name: tcp-istiod
  clusterIP: None
  {{- end }}
---
{{- end }}
{{- if and .Values.global.remotePolicyAddress .Values.global.createRemoteSvcEndpoints }}
apiVersion: v1
kind: Service
metadata:
  name: istio-policy
  namespace: {{ .Release.Namespace }}
spec:
  ports:
  - name: grpc-mixer
    port: 9091
  - name: grpc-mixer-mtls
    port: 15004
  - name: http-monitoring
    port: 15014
  clusterIP: None
---
{{- end }}
{{- if and .Values.global.remoteTelemetryAddress .Values.global.createRemoteSvcEndpoints }}
apiVersion: v1
kind: Service
metadata:
  name: istio-telemetry
  namespace: {{ .Release.Namespace }}
spec:
  ports:
  - name: grpc-mixer
    port: 9091
  - name: grpc-mixer-mtls
    port: 15004
  - name: http-monitoring
    port: 15014
  - name: prometheus
    port: 42422
  clusterIP: None
---
{{- end }}
`)

func chartsBaseTemplatesServicesYamlBytes() ([]byte, error) {
	return _chartsBaseTemplatesServicesYaml, nil
}

func chartsBaseTemplatesServicesYaml() (*asset, error) {
	bytes, err := chartsBaseTemplatesServicesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/base/templates/services.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsBaseValuesYaml = []byte(``)

func chartsBaseValuesYamlBytes() ([]byte, error) {
	return _chartsBaseValuesYaml, nil
}

func chartsBaseValuesYaml() (*asset, error) {
	bytes, err := chartsBaseValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/base/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioEgressChartYaml = []byte(`apiVersion: v1
name: istio-egress
version: 1.1.0
tillerVersion: ">=2.7.2"
description: Helm chart for deploying Istio gateways
keywords:
  - istio
  - egressgateway
  - gateways
sources:
  - http://github.com/istio/istio
engine: gotpl
icon: https://istio.io/favicons/android-192x192.png
`)

func chartsGatewaysIstioEgressChartYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioEgressChartYaml, nil
}

func chartsGatewaysIstioEgressChartYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioEgressChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-egress/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioEgressNotesTxt = []byte(`
Changes:
- separate namespace allows:
-- easier reconfig of just the gateway
-- TLS secrets and domain name management is isolated, for better security
-- simplified configuration
-- multiple versions of the ingress can be used, to minize upgrade risks

- the new chart uses the default namespace service account, and doesn't require
additional RBAC permissions.

- simplified label structure. Label change is not supported on upgrade.

- for 'internal load balancer' you should deploy a separate gateway, in a different
namespace.

All ingress gateway have a "app:ingressgateway" label, used to identify it as an
ingress, and an "istio: ingressgateway$SUFFIX" label of Gateway selection.

The Gateways use "istio: ingressgateway$SUFFIX" selectors.


# Multiple gateway versions



# Using different pilot versions



# Migration from istio-system

Istio 1.0 includes the gateways in istio-system. Since the external IP is associated
with the Service and bound to the namespace, it is recommended to:

1. Install the new gateway in a new namespace.
2. Copy any TLS certificate to the new namespace, and configure the domains.
3. Checking the new gateway work - for example by overriding the IP in /etc/hosts
4. Modify the DNS server to add the A record of the new namespace
5. Check traffic
6. Delete the A record corresponding to the gateway in istio-system
7. Upgrade istio-system, disabling the ingressgateway
8. Delete the domain TLS certs from istio-system.

If using certmanager, all Certificate and associated configs must be moved as well.
`)

func chartsGatewaysIstioEgressNotesTxtBytes() ([]byte, error) {
	return _chartsGatewaysIstioEgressNotesTxt, nil
}

func chartsGatewaysIstioEgressNotesTxt() (*asset, error) {
	bytes, err := chartsGatewaysIstioEgressNotesTxtBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-egress/NOTES.txt", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioEgressTemplates_affinityTpl = []byte(`{{/* affinity - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ */}}

{{- define "nodeaffinity" }}
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityRequiredDuringScheduling" . }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityPreferredDuringScheduling" . }}
{{- end }}

{{- define "nodeAffinityRequiredDuringScheduling" }}
      nodeSelectorTerms:
      - matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
        {{- range $key, $val := .global.arch }}
          {{- if gt ($val | int) 0 }}
          - {{ $key | quote }}
          {{- end }}
        {{- end }}
        {{- $nodeSelector := default .global.defaultNodeSelector .nodeSelector -}}
        {{- range $key, $val := $nodeSelector }}
        - key: {{ $key }}
          operator: In
          values:
          - {{ $val | quote }}
        {{- end }}
{{- end }}

{{- define "nodeAffinityPreferredDuringScheduling" }}
  {{- range $key, $val := .global.arch }}
    {{- if gt ($val | int) 0 }}
    - weight: {{ $val | int }}
      preference:
        matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
          - {{ $key | quote }}
    {{- end }}
  {{- end }}
{{- end }}

{{- define "podAntiAffinity" }}
{{- if or .podAntiAffinityLabelSelector .podAntiAffinityTermLabelSelector}}
  podAntiAffinity:
    {{- if .podAntiAffinityLabelSelector }}
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityRequiredDuringScheduling" . }}
    {{- end }}
    {{- if .podAntiAffinityTermLabelSelector }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityPreferredDuringScheduling" . }}
    {{- end }}
{{- end }}
{{- end }}

{{- define "podAntiAffinityRequiredDuringScheduling" }}
    {{- range $index, $item := .podAntiAffinityLabelSelector }}
    - labelSelector:
        matchExpressions:
        - key: {{ $item.key }}
          operator: {{ $item.operator }}
          {{- if $item.values }}
          values:
          {{- $vals := split "," $item.values }}
          {{- range $i, $v := $vals }}
          - {{ $v | quote }}
          {{- end }}
          {{- end }}
      topologyKey: {{ $item.topologyKey }}
    {{- end }}
{{- end }}

{{- define "podAntiAffinityPreferredDuringScheduling" }}
    {{- range $index, $item := .podAntiAffinityTermLabelSelector }}
    - podAffinityTerm:
        labelSelector:
          matchExpressions:
          - key: {{ $item.key }}
            operator: {{ $item.operator }}
            {{- if $item.values }}
            values:
            {{- $vals := split "," $item.values }}
            {{- range $i, $v := $vals }}
            - {{ $v | quote }}
            {{- end }}
            {{- end }}
        topologyKey: {{ $item.topologyKey }}
      weight: 100
    {{- end }}
{{- end }}
`)

func chartsGatewaysIstioEgressTemplates_affinityTplBytes() ([]byte, error) {
	return _chartsGatewaysIstioEgressTemplates_affinityTpl, nil
}

func chartsGatewaysIstioEgressTemplates_affinityTpl() (*asset, error) {
	bytes, err := chartsGatewaysIstioEgressTemplates_affinityTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-egress/templates/_affinity.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioEgressTemplates_helpersTpl = []byte(`{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "gateway.name" -}}
{{ $gateway := index .Values "gateways" "istio-egressgateway" }}
{{- default .Chart.Name $gateway.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "gateway.fullname" -}}
{{ $gateway := index .Values "gateways" "istio-egressgateway" }}
{{- if $gateway.fullnameOverride -}}
{{- $gateway.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name $gateway.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "gateway.chart" -}}
{{- .Chart.Name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
`)

func chartsGatewaysIstioEgressTemplates_helpersTplBytes() ([]byte, error) {
	return _chartsGatewaysIstioEgressTemplates_helpersTpl, nil
}

func chartsGatewaysIstioEgressTemplates_helpersTpl() (*asset, error) {
	bytes, err := chartsGatewaysIstioEgressTemplates_helpersTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-egress/templates/_helpers.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioEgressTemplatesAutoscaleYaml = []byte(`{{ $gateway := index .Values "gateways" "istio-egressgateway" }}
{{- if and $gateway.autoscaleEnabled $gateway.autoscaleMin $gateway.autoscaleMax }}
apiVersion: autoscaling/v2beta1
kind: HorizontalPodAutoscaler
metadata:
  name: {{ $gateway.name | default "istio-egressgateway" }}
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
spec:
  maxReplicas: {{ $gateway.autoscaleMax }}
  minReplicas: {{ $gateway.autoscaleMin }}
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: {{ $gateway.name | default "istio-egressgateway" }}
  metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageUtilization: {{ $gateway.cpu.targetAverageUtilization }}
---
{{- end }}
`)

func chartsGatewaysIstioEgressTemplatesAutoscaleYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioEgressTemplatesAutoscaleYaml, nil
}

func chartsGatewaysIstioEgressTemplatesAutoscaleYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioEgressTemplatesAutoscaleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-egress/templates/autoscale.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioEgressTemplatesDeploymentYaml = []byte(`{{ $gateway := index .Values "gateways" "istio-egressgateway" }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ $gateway.name | default "istio-egressgateway" }}
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
spec:
{{- if not $gateway.autoscaleEnabled }}
{{- if $gateway.replicaCount }}
  replicas: {{ $gateway.replicaCount }}
{{- end }}
{{- end }}
  selector:
    matchLabels:
{{ $gateway.labels | toYaml | indent 6 }}
  strategy:
    rollingUpdate:
      maxSurge: {{ $gateway.rollingMaxSurge }}
      maxUnavailable: {{ $gateway.rollingMaxUnavailable }}
  template:
    metadata:
      labels:
{{ $gateway.labels | toYaml | indent 8 }}
{{- if eq .Release.Namespace "istio-system"}}
        heritage: Tiller
        release: istio
        chart: gateways
{{- end }}
        service.istio.io/canonical-name: {{ $gateway.name | default "istio-egressgateway" }}
        service.istio.io/canonical-revision: "1.5"
      annotations:
        sidecar.istio.io/inject: "false"
{{- if $gateway.podAnnotations }}
{{ toYaml $gateway.podAnnotations | indent 8 }}
{{ end }}
    spec:
      serviceAccountName: {{ $gateway.name | default "istio-egressgateway" }}-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
{{- if .Values.global.proxy.enableCoreDump }}
      initContainers:
        - name: enable-core-dump
{{- if contains "/" .Values.global.proxy_init.image }}
          image: "{{ .Values.global.proxy_init.image }}"
{{- else }}
          image: "{{ .Values.global.hub }}/{{ .Values.global.proxy_init.image | default "proxy_init" }}:{{ .Values.global.tag }}"
{{- end }}
          imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
          command:
            - /bin/sh
          args:
            - -c
            - sysctl -w kernel.core_pattern=/var/lib/istio/core.proxy && ulimit -c unlimited
          securityContext:
            privileged: true
{{- end }}
      containers:
        - name: istio-proxy
{{- if contains "/" .Values.global.proxy.image }}
          image: "{{ .Values.global.proxy.image }}"
{{- else }}
          image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}"
{{- end }}
          imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
          ports:
            {{- range $key, $val := $gateway.ports }}
            - containerPort: {{ $val.port }}
            {{- end }}
            - containerPort: 15090
              protocol: TCP
              name: http-envoy-prom
          args:
          - proxy
          - router
          - --domain
          - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
        {{- if .Values.global.proxy.logLevel }}
          - --proxyLogLevel={{ .Values.global.proxy.logLevel }}
        {{- end}}
        {{- if .Values.global.proxy.componentLogLevel }}
          - --proxyComponentLogLevel={{ .Values.global.proxy.componentLogLevel }}
        {{- end}}
        {{- if .Values.global.logging.level }}
          - --log_output_level={{ .Values.global.logging.level }}
        {{- end}}
        {{- if .Values.global.logAsJson }}
          - --log_as_json
        {{- end }}
          - --drainDuration
          - '45s' #drainDuration
          - --parentShutdownDuration
          - '1m0s' #parentShutdownDuration
          - --connectTimeout
          - '10s' #connectTimeout
          - --serviceCluster
          - {{ $gateway.name | default "istio-egressgateway" }}
          - --zipkinAddress
        {{- if .Values.global.tracer.zipkin.address }}
          - {{ .Values.global.tracer.zipkin.address }}
        {{- else if .Values.global.telemetryNamespace }}
          - zipkin.{{ .Values.global.telemetryNamespace }}:9411
        {{- else }}
          - zipkin:9411
        {{- end }}
          - --proxyAdminPort
          - "15000"
          - --statusPort
          - "15020"
        {{- if .Values.global.sts.servicePort }}
          - --stsPort={{ .Values.global.sts.servicePort }}
        {{- end }}
        {{- if .Values.global.istiod.enabled }}
          - --controlPlaneAuthPolicy
          - NONE
          - --discoveryAddress
          {{- $namespace := .Values.global.configNamespace | default "istio-system" }}
          {{- if .Values.global.remotePilotAddress }}
          # Use the DNS hostname instead of the IP address. The discovery address needs to match the
          # SAN in istiod's cert. The istiod-remote.<namespace>.svc will resolve to the remotePilotAddress.
          - istiod-remote.{{ $namespace }}.svc:15012
          {{- else }}
          - istio-pilot.{{ $namespace }}.svc:15012
          {{- end }}
        {{- else if .Values.global.controlPlaneSecurityEnabled }}
          - --controlPlaneAuthPolicy
          - MUTUAL_TLS
          - --discoveryAddress
          {{- if .Values.global.configNamespace }}
          - istio-pilot.{{ .Values.global.configNamespace }}:15011
          {{- else }}
          - istio-pilot:15011
          {{- end }}
        {{- else }}
          - --controlPlaneAuthPolicy
          - NONE
          - --discoveryAddress
          {{- if .Values.global.configNamespace }}
          - istio-pilot.{{ .Values.global.configNamespace }}:15010
          {{- else }}
          - istio-pilot:15010
          {{- end }}
        {{- end }}
        {{- if .Values.global.trustDomain }}
          - --trust-domain={{ .Values.global.trustDomain }}
        {{- end }}
          readinessProbe:
            failureThreshold: 30
            httpGet:
              path: /healthz/ready
              port: 15020
              scheme: HTTP
            initialDelaySeconds: 1
            periodSeconds: 2
            successThreshold: 1
            timeoutSeconds: 1
          resources:
{{- if $gateway.resources }}
{{ toYaml $gateway.resources | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 12 }}
{{- end }}
          env:
          - name: JWT_POLICY
            value: {{ .Values.global.jwtPolicy }}
          - name: PILOT_CERT_PROVIDER
            value: {{ .Values.global.pilotCertProvider }}
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: spec.nodeName
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: INSTANCE_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.podIP
          - name: HOST_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.hostIP
          - name: SERVICE_ACCOUNT
            valueFrom:
              fieldRef:
                fieldPath: spec.serviceAccountName
          - name: ISTIO_META_WORKLOAD_NAME
            value: {{ $gateway.name | default "istio-egressgateway" }}
          - name: ISTIO_META_OWNER
            value: kubernetes://apis/apps/v1/namespaces/{{ .Release.Namespace }}/deployments/{{ $gateway.name | default "istio-egressgateway" }}
          {{- if $.Values.global.meshID }}
          - name: ISTIO_META_MESH_ID
            value: "{{ $.Values.global.meshID }}"
          {{- else if $.Values.global.trustDomain }}
          - name: ISTIO_META_MESH_ID
            value: "{{ $.Values.global.trustDomain }}"
          {{- end }}
          {{- if $.Values.global.mtls.auto }}
          - name: ISTIO_AUTO_MTLS_ENABLED
            value: "true"
          {{- end }}
          - name: ISTIO_META_POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: ISTIO_META_CONFIG_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          {{- if $gateway.env }}
          {{- range $key, $val := $gateway.env }}
          - name: {{ $key }}
            value: {{ $val }}
          {{- end }}
          {{ end }}
{{- if $gateway.podAnnotations }}
          - name: "ISTIO_METAJSON_ANNOTATIONS"
            value: |
{{ toJson $gateway.podAnnotations | indent 16}}
{{ end }}
          - name: ISTIO_META_CLUSTER_ID
            value: "{{ $.Values.global.multiCluster.clusterName | default `+"`"+`Kubernetes`+"`"+` }}"
          volumeMounts:
          {{- if eq .Values.global.pilotCertProvider "istiod" }}
          - mountPath: /var/run/secrets/istio
            name: istiod-ca-cert
          {{- end }}
          {{- if .Values.global.istiod.enabled }}
          {{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
          - name: istio-token
            mountPath: /var/run/secrets/tokens
            readOnly: true
          {{- end }}
          {{- end }}
          {{- if .Values.global.mountMtlsCerts }}
          - name: istio-certs
            mountPath: /etc/certs
            readOnly: true
          {{- end }}
          - name: podinfo
            mountPath: /etc/istio/pod
          {{- range $gateway.secretVolumes }}
          - name: {{ .name }}
            mountPath: {{ .mountPath | quote }}
            readOnly: true
          {{- end }}
{{- if $gateway.additionalContainers }}
{{ toYaml $gateway.additionalContainers | indent 8 }}
{{- end }}
      volumes:
      {{- if eq .Values.global.pilotCertProvider "istiod" }}
      - name: istiod-ca-cert
        configMap:
          name: istio-ca-root-cert
      {{- end }}
      - name: podinfo
        downwardAPI:
          items:
            - path: "labels"
              fieldRef:
                fieldPath: metadata.labels
            - path: "annotations"
              fieldRef:
                fieldPath: metadata.annotations
{{- if .Values.global.istiod.enabled }}
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
      - name: istio-token
        projected:
          sources:
          - serviceAccountToken:
              path: istio-token
              expirationSeconds: 43200
              audience: {{ .Values.global.sds.token.aud }}
{{- end }}
{{- end }}
      {{- if .Values.global.mountMtlsCerts }}
      - name: istio-certs
        secret:
          secretName: istio.default
          optional: true
      {{- end }}
      {{- range $gateway.secretVolumes }}
      - name: {{ .name }}
        secret:
          secretName: {{ .secretName | quote }}
          optional: true
      {{- end }}
      {{- range $gateway.configVolumes }}
      - name: {{ .name }}
        configMap:
          name: {{ .configMapName | quote }}
          optional: true
      {{- end }}
      affinity:
      {{- include "nodeaffinity" (dict "global" .Values.global "nodeSelector" $gateway.nodeSelector) | indent 6 }}
      {{- include "podAntiAffinity" $gateway | indent 6 }}
{{- if $gateway.tolerations }}
      tolerations:
{{ toYaml $gateway.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}
`)

func chartsGatewaysIstioEgressTemplatesDeploymentYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioEgressTemplatesDeploymentYaml, nil
}

func chartsGatewaysIstioEgressTemplatesDeploymentYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioEgressTemplatesDeploymentYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-egress/templates/deployment.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioEgressTemplatesPoddisruptionbudgetYaml = []byte(`{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
{{ $gateway := index .Values "gateways" "istio-egressgateway" }}
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: {{ $gateway.name | default "istio-egressgateway" }}
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
spec:
  minAvailable: 1
  selector:
    matchLabels:
{{ $gateway.labels | toYaml | indent 6 }}
      release: {{ .Release.Name }}
{{- end }}
`)

func chartsGatewaysIstioEgressTemplatesPoddisruptionbudgetYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioEgressTemplatesPoddisruptionbudgetYaml, nil
}

func chartsGatewaysIstioEgressTemplatesPoddisruptionbudgetYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioEgressTemplatesPoddisruptionbudgetYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-egress/templates/poddisruptionbudget.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioEgressTemplatesPreconfiguredYaml = []byte(`{{ $gateway := index .Values "gateways" "istio-egressgateway" }}
{{- if $gateway.zvpn.enabled }}
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-multicluster-egressgateway
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
spec:
  selector:
    istio: egressgateway
  servers:
  - hosts:
    - "*.{{ $gateway.zvpn.suffix }}"
    port:
      name: tls
      number: 15443
      protocol: TLS
    tls: {}
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: istio-multicluster-egressgateway
  namespace: {{ .Release.Namespace }} 
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
spec:
  gateways:
  - istio-multicluster-egressgateway
  hosts:
  - "*.{{ $gateway.zvpn.suffix }}"
  tls:
  - match:
    - port: 15443
      sniHosts:
      - "*.{{ $gateway.zvpn.suffix }}"
    route:
    - destination:
        host: non.existent.cluster
        port:
          number: 15443
      weight: 100
---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: istio-multicluster-egressgateway
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
spec:
  workloadLabels:
    istio: egressgateway
  filters:
  - listenerMatch:
      portNumber: 15443
      listenerType: GATEWAY
    filterName: envoy.filters.network.sni_cluster
    filterType: NETWORK
    filterConfig: {}
---
## To ensure all traffic to *.global is using mTLS
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: istio-multicluster-egressgateway
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
spec:
  host: "*.{{ $gateway.zvpn.suffix }}"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
{{- end }}
`)

func chartsGatewaysIstioEgressTemplatesPreconfiguredYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioEgressTemplatesPreconfiguredYaml, nil
}

func chartsGatewaysIstioEgressTemplatesPreconfiguredYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioEgressTemplatesPreconfiguredYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-egress/templates/preconfigured.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioEgressTemplatesServiceYaml = []byte(`{{ $gateway := index .Values "gateways" "istio-egressgateway" }}
apiVersion: v1
kind: Service
metadata:
  name: {{ $gateway.name | default "istio-egressgateway" }}
  namespace: {{ .Release.Namespace }}
  annotations:
    {{- range $key, $val := $gateway.serviceAnnotations }}
    {{ $key }}: {{ $val | quote }}
    {{- end }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
spec:
  type: ClusterIP
  selector:
{{ $gateway.labels | toYaml | indent 4 }}
  ports:
    {{- range $key, $val := $gateway.ports }}
    -
      {{- range $pkey, $pval := $val }}
      {{ $pkey}}: {{ $pval }}
      {{- end }}
    {{- end }}
---
`)

func chartsGatewaysIstioEgressTemplatesServiceYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioEgressTemplatesServiceYaml, nil
}

func chartsGatewaysIstioEgressTemplatesServiceYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioEgressTemplatesServiceYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-egress/templates/service.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioEgressTemplatesServiceaccountYaml = []byte(`{{ $gateway := index .Values "gateways" "istio-egressgateway" }}
apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end }}
metadata:
  name: {{ $gateway.name | default "istio-egressgateway" }}-service-account
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
`)

func chartsGatewaysIstioEgressTemplatesServiceaccountYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioEgressTemplatesServiceaccountYaml, nil
}

func chartsGatewaysIstioEgressTemplatesServiceaccountYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioEgressTemplatesServiceaccountYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-egress/templates/serviceaccount.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioEgressValuesYaml = []byte(`# Standalone istio egress gateway.
# Should be installed in a separate namespace, to minimize access to config
gateways:
  istio-egressgateway:
    name: istio-egressgateway
    ports:
    - port: 80
      name: http2
    - port: 443
      name: https
      # This is the port where sni routing happens
    - port: 15443
      targetPort: 15443
      name: tls

    # Enable cross-cluster access using SNI matching.
    # Make sure you set suffix if deploying multiple egress gateways.
    zvpn:
      # Must be different for each egress namespace.
      # Used to control the domain name suffix for zero vpn routing.
      # Domain names ending with this suffix will be routed to this egress gateway
      # automatically.
      # This can be a real domain name ( istio.example.com )
      suffix: global
      enabled: false

    labels:
      app: istio-egressgateway
      istio: egressgateway


    # Scalability tunning
    # replicaCount: 1
    rollingMaxSurge: 100%
    rollingMaxUnavailable: 25%
    autoscaleEnabled: true
    autoscaleMin: 1
    autoscaleMax: 5
    resources:
      requests:
        cpu: 100m
        memory: 128Mi
      limits:
        cpu: 2000m
        memory: 1024Mi
    cpu:
      targetAverageUtilization: 80

    drainDuration: 45s
    connectTimeout: 10s

    serviceAnnotations: {}
    podAnnotations: {}
    type: ClusterIP # change to NodePort or LoadBalancer if need be

    secretVolumes:
    - name: egressgateway-certs
      secretName: istio-egressgateway-certs
      mountPath: /etc/istio/egressgateway-certs
    - name: egressgateway-ca-certs
      secretName: istio-egressgateway-ca-certs
      mountPath: /etc/istio/egressgateway-ca-certs

    configVolumes: []
    additionalContainers: []
    ### Advanced options ############
    # TODO: convert to real options, env should not be exposed
    env:
      # Set this to "external" if and only if you want the egress gateway to
      # act as a transparent SNI gateway that routes mTLS/TLS traffic to
      # external services defined using service entries, where the service
      # entry has resolution set to DNS, has one or more endpoints with
      # network field set to "external". By default its set to "" so that
      # the egress gateway sees the same set of endpoints as the sidecars
      # preserving backward compatibility
      # ISTIO_META_REQUESTED_NETWORK_VIEW: ""
      # A gateway with this mode ensures that pilot generates an additional
      # set of clusters for internal services but without Istio mTLS, to
      # enable cross cluster routing.
      ISTIO_META_ROUTER_MODE: "sni-dnat"

    nodeSelector: {}
    tolerations: []

    # Specify the pod anti-affinity that allows you to constrain which nodes
    # your pod is eligible to be scheduled based on labels on pods that are
    # already running on the node rather than based on labels on nodes.
    # There are currently two types of anti-affinity:
    #    "requiredDuringSchedulingIgnoredDuringExecution"
    #    "preferredDuringSchedulingIgnoredDuringExecution"
    # which denote "hard" vs. "soft" requirements, you can define your values
    # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
    # correspondingly.
    # For example:
    # podAntiAffinityLabelSelector:
    # - key: security
    #   operator: In
    #   values: S1,S2
    #   topologyKey: "kubernetes.io/hostname"
    # This pod anti-affinity rule says that the pod requires not to be scheduled
    # onto a node if that node is already running a pod with label having key
    # "security" and value "S1".
    podAntiAffinityLabelSelector: []
    podAntiAffinityTermLabelSelector: []
`)

func chartsGatewaysIstioEgressValuesYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioEgressValuesYaml, nil
}

func chartsGatewaysIstioEgressValuesYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioEgressValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-egress/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressChartYaml = []byte(`apiVersion: v1
name: istio-ingress
version: 1.1.0
tillerVersion: ">=2.7.2"
description: Helm chart for deploying Istio gateways
keywords:
  - istio
  - ingressgateway
  - gateways
sources:
  - http://github.com/istio/istio
engine: gotpl
icon: https://istio.io/favicons/android-192x192.png
`)

func chartsGatewaysIstioIngressChartYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressChartYaml, nil
}

func chartsGatewaysIstioIngressChartYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressNotesTxt = []byte(`
Changes:
- separate namespace allows:
-- easier reconfig of just the gateway
-- TLS secrets and domain name management is isolated, for better security
-- simplified configuration
-- multiple versions of the ingress can be used, to minimize upgrade risks

- the new chart uses the default namespace service account, and doesn't require
additional RBAC permissions.

- simplified label and chart structure.
- ability to run a pilot dedicated for the gateway, isolated from the main pilot. This is more robust, safer on upgrades
and allows a bit more flexibility.
- the dedicated pilot-per-ingress is required if the gateway needs to support k8s-style ingress.

# Port and basic host configuration

In order to configure the Service object, the install/upgrade needs to provide a list of all ports.
In the past, this was done when installing/upgrading full istio, and involved some duplication - ports configured
both in upgrade, Gateway and VirtualService.

The new Ingress chart uses a 'values.yaml' (see user-example-ingress), which auto-generates Service ports,
Gateways and basic VirtualService. It is still possible to only configure the ports in Service, and do manual
config for the rest.

All internal services ( telemetry, pilot debug ports, mesh expansion ) can now be configured via the new mechanism.

# Migration from istio-system

Istio 1.0 includes the gateways in istio-system. Since the external IP is associated
with the Service and bound to the namespace, it is recommended to:

1. Install the new gateway in a new namespace.
2. Copy any TLS certificate to the new namespace, and configure the domains.
3. Checking the new gateway work - for example by overriding the IP in /etc/hosts
4. Modify the DNS server to add the A record of the new namespace
5. Check traffic
6. Delete the A record corresponding to the gateway in istio-system
7. Upgrade istio-system, disabling the ingressgateway
8. Delete the domain TLS certs from istio-system.

If using certmanager, all Certificate and associated configs must be moved as well.
`)

func chartsGatewaysIstioIngressNotesTxtBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressNotesTxt, nil
}

func chartsGatewaysIstioIngressNotesTxt() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressNotesTxtBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/NOTES.txt", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressTemplates_affinityTpl = []byte(`{{/* affinity - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ */}}

{{- define "nodeaffinity" }}
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityRequiredDuringScheduling" . }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityPreferredDuringScheduling" . }}
{{- end }}

{{- define "nodeAffinityRequiredDuringScheduling" }}
      nodeSelectorTerms:
      - matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
        {{- range $key, $val := .global.arch }}
          {{- if gt ($val | int) 0 }}
          - {{ $key | quote }}
          {{- end }}
        {{- end }}
        {{- $nodeSelector := default .global.defaultNodeSelector .nodeSelector -}}
        {{- range $key, $val := $nodeSelector }}
        - key: {{ $key }}
          operator: In
          values:
          - {{ $val | quote }}
        {{- end }}
{{- end }}

{{- define "nodeAffinityPreferredDuringScheduling" }}
  {{- range $key, $val := .global.arch }}
    {{- if gt ($val | int) 0 }}
    - weight: {{ $val | int }}
      preference:
        matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
          - {{ $key | quote }}
    {{- end }}
  {{- end }}
{{- end }}

{{- define "podAntiAffinity" }}
{{- if or .podAntiAffinityLabelSelector .podAntiAffinityTermLabelSelector}}
  podAntiAffinity:
    {{- if .podAntiAffinityLabelSelector }}
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityRequiredDuringScheduling" . }}
    {{- end }}
    {{- if .podAntiAffinityTermLabelSelector }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityPreferredDuringScheduling" . }}
    {{- end }}
{{- end }}
{{- end }}

{{- define "podAntiAffinityRequiredDuringScheduling" }}
    {{- range $index, $item := .podAntiAffinityLabelSelector }}
    - labelSelector:
        matchExpressions:
        - key: {{ $item.key }}
          operator: {{ $item.operator }}
          {{- if $item.values }}
          values:
          {{- $vals := split "," $item.values }}
          {{- range $i, $v := $vals }}
          - {{ $v | quote }}
          {{- end }}
          {{- end }}
      topologyKey: {{ $item.topologyKey }}
    {{- end }}
{{- end }}

{{- define "podAntiAffinityPreferredDuringScheduling" }}
    {{- range $index, $item := .podAntiAffinityTermLabelSelector }}
    - podAffinityTerm:
        labelSelector:
          matchExpressions:
          - key: {{ $item.key }}
            operator: {{ $item.operator }}
            {{- if $item.values }}
            values:
            {{- $vals := split "," $item.values }}
            {{- range $i, $v := $vals }}
            - {{ $v | quote }}
            {{- end }}
            {{- end }}
        topologyKey: {{ $item.topologyKey }}
      weight: 100
    {{- end }}
{{- end }}
`)

func chartsGatewaysIstioIngressTemplates_affinityTplBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressTemplates_affinityTpl, nil
}

func chartsGatewaysIstioIngressTemplates_affinityTpl() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressTemplates_affinityTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/templates/_affinity.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressTemplatesAddongatewayYaml = []byte(`# Template for telemetry addon gateways
{{ $gateway := index .Values "gateways" "istio-ingressgateway" }}
{{ range $addon := $gateway.telemetry_addon_gateways }}
{{ if $addon.enabled }}
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-{{ $addon.name }}-gateway
  namespace: {{ $.Release.Namespace }}
  labels:
    app: {{ $addon.name }}
    release: {{ $.Release.Name }}
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: {{ $addon.port }}
        name: https-{{ $addon.name }}
        protocol: HTTPS
      tls:
        mode: SIMPLE
        serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
        privateKey: /etc/istio/ingressgateway-certs/tls.key
      hosts:
        - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: {{ $addon.name }}-virtual-service
  namespace: {{ $.Release.Namespace }}
  labels:
    app: {{ $addon.name }}
    release: {{ $.Release.Name }}
spec:
  hosts:
    - "*"
  gateways:
    - istio-{{ $addon.name }}-gateway
  http:
    - match:
        - port: {{ $addon.port }}
      route:
        - destination:
            host: {{ $addon.name }}.{{ $.Release.Namespace }}.svc.{{ $.Values.global.proxy.clusterDomain }}
            port:
              number: {{ $addon.desPort }}
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: {{ $addon.name }}
  namespace: {{ $.Release.Namespace }}
  labels:
    app: {{ $addon.name }}
    release: {{ $.Release.Name }}
spec:
  host: {{ $addon.name }}.{{ $.Release.Namespace }}.svc.{{ $.Values.global.proxy.clusterDomain }}
  trafficPolicy:
    tls:
      mode: DISABLE
---
{{- end }}
{{- end }}
`)

func chartsGatewaysIstioIngressTemplatesAddongatewayYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressTemplatesAddongatewayYaml, nil
}

func chartsGatewaysIstioIngressTemplatesAddongatewayYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressTemplatesAddongatewayYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/templates/addongateway.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressTemplatesAutoscaleYaml = []byte(`{{ $gateway := index .Values "gateways" "istio-ingressgateway" }}
{{- if and $gateway.autoscaleEnabled $gateway.autoscaleMin $gateway.autoscaleMax }}
apiVersion: autoscaling/v2beta1
kind: HorizontalPodAutoscaler
metadata:
  name: {{ $gateway.name | default "istio-ingressgateway" }}
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
spec:
  maxReplicas: {{ $gateway.autoscaleMax }}
  minReplicas: {{ $gateway.autoscaleMin }}
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: {{ $gateway.name | default "istio-ingressgateway" }}
  metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageUtilization: {{ $gateway.cpu.targetAverageUtilization }}
---
{{- end }}
`)

func chartsGatewaysIstioIngressTemplatesAutoscaleYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressTemplatesAutoscaleYaml, nil
}

func chartsGatewaysIstioIngressTemplatesAutoscaleYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressTemplatesAutoscaleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/templates/autoscale.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressTemplatesCertificateYaml = []byte(`{{ $gateway := index .Values "gateways" "istio-ingressgateway" }}
{{ if $gateway.certificates }}
---
# Auto-generate Certmanager Issuer and certificate requests.
# Requires 'email' to be set, for Let's Encrypt use.

apiVersion: certmanager.k8s.io/v1alpha1
kind: Issuer
metadata:
  name: letsencrypt
  namespace: {{ .Release.Namespace }}
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: {{ $gateway.email }}
    privateKeySecretRef:
      name: letsencrypt
    http01: {}
---

apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: istio-ingressgateway-certs
  namespace: {{ .Release.Namespace }}
spec:
  secretName: istio-ingressgateway-certs
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer
  commonName: {{ $gateway.commonName }}
  dnsNames:
{{- range $key := $gateway.certificates }}
  - {{ $key }}
{{- end }}
  acme:
    config:
    - http01:
        ingressClass: istio
      domains:
{{- range $key := $gateway.certificates }}
      - {{ $key }}
{{- end }}
{{- end }}

`)

func chartsGatewaysIstioIngressTemplatesCertificateYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressTemplatesCertificateYaml, nil
}

func chartsGatewaysIstioIngressTemplatesCertificateYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressTemplatesCertificateYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/templates/certificate.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressTemplatesDeploymentYaml = []byte(`{{- $gateway := index .Values "gateways" "istio-ingressgateway" }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ $gateway.name | default "istio-ingressgateway" }}
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
spec:
{{- if not $gateway.autoscaleEnabled }}
{{- if $gateway.replicaCount }}
  replicas: {{ $gateway.replicaCount }}
{{- end }}
{{- end }}
  selector:
    matchLabels:
{{ $gateway.labels | toYaml | indent 6 }}
  strategy:
    rollingUpdate:
      maxSurge: {{ $gateway.rollingMaxSurge }}
      maxUnavailable: {{ $gateway.rollingMaxUnavailable }}
  template:
    metadata:
      labels:
{{ $gateway.labels | toYaml | indent 8 }}
{{- if eq .Release.Namespace "istio-system"}}
        heritage: Tiller
        release: istio
        chart: gateways
{{- end }}
        service.istio.io/canonical-name: {{ $gateway.name | default "istio-ingressgateway" }}
        service.istio.io/canonical-revision: "1.5"
      annotations:
        sidecar.istio.io/inject: "false"
{{- if $gateway.podAnnotations }}
{{ toYaml $gateway.podAnnotations | indent 8 }}
{{ end }}
    spec:
      serviceAccountName: {{ $gateway.name | default "istio-ingressgateway" }}-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
{{- if .Values.global.proxy.enableCoreDump }}
      initContainers:
        - name: enable-core-dump
{{- if contains "/" .Values.global.proxy.image }}
          image: "{{ .Values.global.proxy.image }}"
{{- else }}
          image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image | default "proxyv2" }}:{{ .Values.global.tag }}"
{{- end }}
          imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
          command:
            - /bin/sh
          args:
            - -c
            - sysctl -w kernel.core_pattern=/var/lib/istio/core.proxy && ulimit -c unlimited
          securityContext:
            privileged: true
{{- end }}
      containers:
{{- if and $gateway.sds.enabled (not .Values.global.istiod.enabled) }}
        - name: ingress-sds
{{- if contains "/" $gateway.sds.image }}
          image: "{{ $gateway.sds.image }}"
{{- else }}
          image: "{{ .Values.global.hub }}/{{ $gateway.sds.image }}:{{ .Values.global.tag }}"
{{- end }}
          imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
          resources:
{{- if $gateway.sds.resources }}
{{ toYaml $gateway.sds.resources | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 12 }}
{{- end }}
          env:
          - name: "ENABLE_WORKLOAD_SDS"
            value: "false"
          - name: "ENABLE_INGRESS_GATEWAY_SDS"
            value: "true"
          - name: "INGRESS_GATEWAY_NAMESPACE"
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          volumeMounts:
          - name: ingressgatewaysdsudspath
            mountPath: /var/run/ingress_gateway
{{- end }}
        - name: istio-proxy
{{- if contains "/" .Values.global.proxy.image }}
          image: "{{ .Values.global.proxy.image }}"
{{- else }}
          image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image | default "proxyv2" }}:{{ .Values.global.tag }}"
{{- end }}
          imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
          ports:
            {{- range $key, $val := $gateway.ports }}
            - containerPort: {{ $val.port }}
            {{- end }}
            {{- range $key, $val := $gateway.meshExpansionPorts }}
            - containerPort: {{ $val.port }}
            {{- end }}
            - containerPort: 15090
              protocol: TCP
              name: http-envoy-prom
          args:
          - proxy
          - router
          - --domain
          - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
        {{- if .Values.global.proxy.logLevel }}
          - --proxyLogLevel={{ .Values.global.proxy.logLevel }}
        {{- end}}
        {{- if .Values.global.proxy.componentLogLevel }}
          - --proxyComponentLogLevel={{ .Values.global.proxy.componentLogLevel }}
        {{- end}}
        {{- if .Values.global.logging.level }}
          - --log_output_level={{ .Values.global.logging.level }}
        {{- end}}
        {{- if .Values.global.logAsJson }}
          - --log_as_json
        {{- end }}
          - --drainDuration
          - '45s' #drainDuration
          - --parentShutdownDuration
          - '1m0s' #parentShutdownDuration
          - --connectTimeout
          - '10s' #connectTimeout
          - --serviceCluster
          - {{ $gateway.name | default "istio-ingressgateway" }}
          - --zipkinAddress
        {{- if .Values.global.tracer.zipkin.address }}
          - {{ .Values.global.tracer.zipkin.address }}
        {{- else if .Values.global.telemetryNamespace }}
          - zipkin.{{ .Values.global.telemetryNamespace }}:9411
        {{- else }}
          - zipkin:9411
        {{- end }}
        {{- if $.Values.global.proxy.envoyMetricsService.enabled }}
          - --envoyMetricsService
          {{- with  $.Values.global.proxy.envoyMetricsService }}
          - '{"address":"{{ .host }}:{{.port }}"{{ if .tlsSettings }},"tlsSettings":{{ .tlsSettings | toJson }}{{- end }}{{ if .tcpKeepalive }},"tcpKeepalive":{{ .tcpKeepalive | toJson }}{{- end }}}'
          {{- end }}
        {{- end}}
        {{- if $.Values.global.proxy.envoyAccessLogService.enabled }}
          - --envoyAccessLogService
          {{- with  $.Values.global.proxy.envoyAccessLogService }}
          - '{"address":"{{ .host }}:{{.port }}"{{ if .tlsSettings }},"tlsSettings":{{ .tlsSettings | toJson }}{{- end }}{{ if .tcpKeepalive }},"tcpKeepalive":{{ .tcpKeepalive | toJson }}{{- end }}}'
          {{- end }}
        {{- end }}
          - --proxyAdminPort
          - "15000"
          - --statusPort
          - "15020"
        {{- if .Values.global.sts.servicePort }}
          - --stsPort={{ .Values.global.sts.servicePort }}
        {{- end }}
          {{- if .Values.global.istiod.enabled }}
          - --controlPlaneAuthPolicy
          - NONE
          - --discoveryAddress
          {{- $namespace := .Values.global.configNamespace | default "istio-system" }}
          {{- if .Values.global.remotePilotAddress }}
          # Use the DNS hostname instead of the IP address. The discovery address needs to match the
          # SAN in istiod's cert. The istiod-remote.<namespace>.svc will resolve to the remotePilotAddress.
          - istiod-remote.{{ $namespace }}.svc:15012
          {{- else }}
          - istio-pilot.{{ $namespace }}.svc:15012
          {{- end }}
          {{- else if .Values.global.controlPlaneSecurityEnabled }}
          - --controlPlaneAuthPolicy
          - MUTUAL_TLS
          - --discoveryAddress
          {{- if .Values.global.configNamespace }}
          - istio-pilot.{{ .Values.global.configNamespace }}:15011
          {{- else }}
          - istio-pilot:15011
          {{- end }}
        {{- else }}
          - --controlPlaneAuthPolicy
          - NONE
          - --discoveryAddress
          {{- if .Values.global.configNamespace }}
          - istio-pilot.{{ .Values.global.configNamespace }}:15010
          {{- else }}
          - istio-pilot:15010
          {{- end }}
        {{- end }}
        {{- if .Values.global.trustDomain }}
          - --trust-domain={{ .Values.global.trustDomain }}
        {{- end }}
          readinessProbe:
            failureThreshold: 30
            httpGet:
              path: /healthz/ready
              port: 15020
              scheme: HTTP
            initialDelaySeconds: 1
            periodSeconds: 2
            successThreshold: 1
            timeoutSeconds: 1
          resources:
{{- if $gateway.resources }}
{{ toYaml $gateway.resources | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 12 }}
{{- end }}
          env:
          - name: JWT_POLICY
            value: {{ .Values.global.jwtPolicy }}
          - name: PILOT_CERT_PROVIDER
            value: {{ .Values.global.pilotCertProvider }}
{{- if or .Values.global.istiod.enabled $gateway.sds.enabled }}
          - name: "ISTIO_META_USER_SDS"
            value: "true"
{{- if .Values.global.istiod.enabled }}
          - name: CA_ADDR
          {{- if .Values.global.caAddress }}
            value: {{ .Values.global.caAddress }}
          {{- else if .Values.global.configNamespace }}
            value: istio-pilot.{{ .Values.global.configNamespace }}.svc:15012
          {{- else }}
            value: istio-pilot.istio-system.svc:15012
          {{- end }}
{{- end }}
{{- end }}
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: spec.nodeName
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: INSTANCE_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.podIP
          - name: HOST_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.hostIP
          - name: SERVICE_ACCOUNT
            valueFrom:
              fieldRef:
                fieldPath: spec.serviceAccountName
          - name: ISTIO_META_WORKLOAD_NAME
            value: {{ $gateway.name | default "istio-ingressgateway" }}
          - name: ISTIO_META_OWNER
            value: kubernetes://apis/apps/v1/namespaces/{{ .Release.Namespace }}/deployments/{{ $gateway.name | default "istio-ingressgateway" }}
          {{- if $.Values.global.meshID }}
          - name: ISTIO_META_MESH_ID
            value: "{{ $.Values.global.meshID }}"
          {{- else if $.Values.global.trustDomain }}
          - name: ISTIO_META_MESH_ID
            value: "{{ $.Values.global.trustDomain }}"
          {{- end }}
          {{- if $.Values.global.mtls.auto }}
          - name: ISTIO_AUTO_MTLS_ENABLED
            value: "true"
          {{- end }}
          - name: ISTIO_META_POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: ISTIO_META_CONFIG_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          {{- range $key, $val := $gateway.env }}
          - name: {{ $key }}
            value: {{ $val }}
          {{- end }}
          {{ $network_set := index $gateway.env "ISTIO_META_NETWORK" }}
          {{- if and (not $network_set) .Values.global.network }}
          - name: ISTIO_META_NETWORK
            value: {{ .Values.global.network }}
          {{- end }}
{{- if $gateway.podAnnotations }}
          - name: "ISTIO_METAJSON_ANNOTATIONS"
            value: |
{{ toJson $gateway.podAnnotations | indent 16}}
{{ end }}
          - name: ISTIO_META_CLUSTER_ID
            value: "{{ $.Values.global.multiCluster.clusterName | default `+"`"+`Kubernetes`+"`"+` }}"
          volumeMounts:
{{- if eq .Values.global.pilotCertProvider "istiod" }}
          - mountPath: /var/run/secrets/istio
            name: istiod-ca-cert
{{- end }}
{{- if .Values.global.istiod.enabled }}
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
          - name: istio-token
            mountPath: /var/run/secrets/tokens
            readOnly: true
{{- end }}
          - name: ingressgatewaysdsudspath
            mountPath: /var/run/ingress_gateway
{{ else }}
          {{- if $gateway.sds.enabled }}
          - name: ingressgatewaysdsudspath
            mountPath: /var/run/ingress_gateway
          {{- end }}
{{- end }}
          {{- if .Values.global.mountMtlsCerts }}
          # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
          - name: istio-certs
            mountPath: /etc/certs
            readOnly: true
          {{- end }}
          - name: podinfo
            mountPath: /etc/istio/pod
          {{- range $gateway.secretVolumes }}
          - name: {{ .name }}
            mountPath: {{ .mountPath | quote }}
            readOnly: true
          {{- end }}
{{- if $gateway.additionalContainers }}
{{ toYaml $gateway.additionalContainers | indent 8 }}
{{- end }}
      volumes:
{{- if eq .Values.global.pilotCertProvider "istiod" }}
      - name: istiod-ca-cert
        configMap:
          name: istio-ca-root-cert
{{- end }}
      - name: podinfo
        downwardAPI:
          items:
          - path: "labels"
            fieldRef:
              fieldPath: metadata.labels
          - path: "annotations"
            fieldRef:
              fieldPath: metadata.annotations
{{- if .Values.global.istiod.enabled }}
      - name: ingressgatewaysdsudspath
        emptyDir: {}
{{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
      - name: istio-token
        projected:
          sources:
          - serviceAccountToken:
              path: istio-token
              expirationSeconds: 43200
              audience: {{ .Values.global.sds.token.aud }}
{{- end }}
{{- else }}
      {{- if $gateway.sds.enabled }}
      - name: ingressgatewaysdsudspath
        emptyDir: {}
      {{- end }}
{{- end }}
      {{- if .Values.global.mountMtlsCerts }}
      # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
      - name: istio-certs
        secret:
          secretName: istio.{{ $gateway.name | default "istio-ingressgateway" }}-service-account
          optional: true
      {{- end }}
      {{- range $gateway.secretVolumes }}
      - name: {{ .name }}
        secret:
          secretName: {{ .secretName | quote }}
          optional: true
      {{- end }}
      {{- range $gateway.configVolumes }}
      - name: {{ .name }}
        configMap:
          name: {{ .configMapName | quote }}
          optional: true
      {{- end }}
      affinity:
      {{- include "nodeaffinity" (dict "global" .Values.global "nodeSelector" $gateway.nodeSelector) | indent 6 }}
      {{- include "podAntiAffinity" $gateway | indent 6 }}
{{- if $gateway.tolerations }}
      tolerations:
{{ toYaml $gateway.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}
`)

func chartsGatewaysIstioIngressTemplatesDeploymentYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressTemplatesDeploymentYaml, nil
}

func chartsGatewaysIstioIngressTemplatesDeploymentYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressTemplatesDeploymentYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/templates/deployment.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressTemplatesGatewayYaml = []byte(`{{ $gateway := index .Values "gateways" "istio-ingressgateway" }}
# Main Gateway. Apps must bind to NAMESPACE/ingressgateway
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: {{ $gateway.name | default "ingressgateway" }}
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
spec:
  selector:
{{ $gateway.labels | toYaml | indent 4 }}
  servers:
{{- if $gateway.tls }}
  - port:
      number: 443
      name: https-default
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
      - "*"
  {{- end }}
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
      - "*"
    # Additional ports in gateaway for the ingressPorts - apps using dedicated port instead of hostname
{{ range $app := $gateway.ingressPorts }}
  - port:
      number: {{ $app.port }}
      name: {{ $app.name }}
      protocol: HTTP2
    hosts:
    - "*"
{{- end }}
`)

func chartsGatewaysIstioIngressTemplatesGatewayYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressTemplatesGatewayYaml, nil
}

func chartsGatewaysIstioIngressTemplatesGatewayYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressTemplatesGatewayYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/templates/gateway.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressTemplatesHostsYaml = []byte(`{{ $gateway := index .Values "gateways" "istio-ingressgateway" }}

# TODO: range TCP ports, add ports
# {{ $gateway.domain }}
{{ range $app := $gateway.hosts }}
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: {{ $app.name }}
  namespace: {{ $.Release.Namespace }}
  labels:
    release: {{ $.Release.Name }}
spec:
  hosts:
  - "{{ $app.name }}.{{ $gateway.domain }}"
  gateways:
  - ingressgateway
  http:
  - route:
    - destination:
        host: {{ $app.dest }}
        port:
          number: {{ $app.destPort }}
{{- end }}

{{ range $app := $gateway.ingressPorts }}
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: {{ $app.name }}
  namespace: {{ $.Release.Namespace }}
  labels:
    release: {{ $.Release.Name }}
spec:
  hosts:
  - "*"
  gateways:
  - ingressgateway
  http:
  -
    match:
    - port: {{ $app.port }}
    route:
    - destination:
        host: {{ $app.dest }}
        port:
          number: {{ $app.destPort }}
{{- end }}
`)

func chartsGatewaysIstioIngressTemplatesHostsYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressTemplatesHostsYaml, nil
}

func chartsGatewaysIstioIngressTemplatesHostsYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressTemplatesHostsYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/templates/hosts.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressTemplatesMeshexpansionYaml = []byte(`{{- if .Values.global.meshExpansion.enabled }}
  {{- if .Values.global.istiod.enabled }}
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: meshexpansion-gateway
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 15012
        protocol: TCP
        name: tcp-istiod
      hosts:
        - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: meshexpansion-vs-istiod
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
spec:
  hosts:
  - istiod.{{ .Values.global.istioNamespace }}.svc.{{ .Values.global.proxy.clusterDomain }}
  gateways:
  - meshexpansion-gateway
  tcp:
  - match:
    - port: 15012
    route:
    - destination:
        host: istiod.{{ .Values.global.istioNamespace }}.svc.{{ .Values.global.proxy.clusterDomain }}
        port:
          number: 15012
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: meshexpansion-dr-istiod
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
spec:
  host: istiod.{{ .Release.Namespace }}.svc.{{ .Values.global.proxy.clusterDomain }}
  trafficPolicy:
    portLevelSettings:
    - port:
        number: 15012
      tls:
        mode: DISABLE
---
  {{- else }}
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: meshexpansion-gateway
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 15011
        protocol: TCP
        name: tcp-pilot
      hosts:
        - "*"
    - port:
        number: 15004
        name: tls-mixer
        protocol: TLS
      tls:
        mode: AUTO_PASSTHROUGH
      hosts:
        - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: meshexpansion-vs-pilot
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
spec:
  hosts:
    - istio-pilot.{{ .Values.global.istioNamespace }}.svc.{{ .Values.global.proxy.clusterDomain }}
  gateways:
    - meshexpansion-gateway
  tcp:
    - match:
        - port: 15011
      route:
        - destination:
            host: istio-pilot.{{ .Values.global.istioNamespace }}.svc.{{ .Values.global.proxy.clusterDomain }}
            port:
              number: 15011
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: meshexpansion-dr-pilot
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
spec:
  host: pilot.{{ .Release.Namespace }}.svc.{{ .Values.global.proxy.clusterDomain }}
  trafficPolicy:
    portLevelSettings:
      - port:
          number: 15011
        tls:
          mode: DISABLE
  {{- end }}
{{- end }}

`)

func chartsGatewaysIstioIngressTemplatesMeshexpansionYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressTemplatesMeshexpansionYaml, nil
}

func chartsGatewaysIstioIngressTemplatesMeshexpansionYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressTemplatesMeshexpansionYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/templates/meshexpansion.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressTemplatesPoddisruptionbudgetYaml = []byte(`{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
{{ $gateway := index .Values "gateways" "istio-ingressgateway" }}
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: {{ $gateway.name | default "istio-ingressgateway" }}
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
spec:
  minAvailable: 1
  selector:
    matchLabels:
{{ $gateway.labels | toYaml | indent 6 }}
      release: {{ .Release.Name }}
{{- end }}
`)

func chartsGatewaysIstioIngressTemplatesPoddisruptionbudgetYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressTemplatesPoddisruptionbudgetYaml, nil
}

func chartsGatewaysIstioIngressTemplatesPoddisruptionbudgetYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressTemplatesPoddisruptionbudgetYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/templates/poddisruptionbudget.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressTemplatesPreconfiguredYaml = []byte(`{{ $gateway := index .Values "gateways" "istio-ingressgateway" }}
{{- if .Values.global.k8sIngress.enabled }}
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-autogenerated-k8s-ingress
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
spec:
  selector:
    istio: {{ .Values.global.k8sIngress.gatewayName }}
  servers:
  - port:
      number: 80
      protocol: HTTP
      name: http
    hosts:
    - "*"
{{ if .Values.global.k8sIngress.enableHttps }}
  - port:
      number: 443
      protocol: HTTPS
      name: https-default
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
    - "*"
{{ end }}
---
{{ end }}


{{- if .Values.global.multiCluster.enabled }}
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-multicluster-ingressgateway
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - "*.global"
    port:
      name: tls
      number: 15443
      protocol: TLS
    tls:
      mode: AUTO_PASSTHROUGH
---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: istio-multicluster-ingressgateway
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      context: GATEWAY
      listener:
        portNumber: 15443
        filterChain:
          filter:
            name: "envoy.filters.network.sni_cluster"
    patch:
      operation: INSERT_AFTER
      value:
        name: "envoy.filters.network.tcp_cluster_rewrite"
        config:
          cluster_pattern: "\\.global$"
          cluster_replacement: ".svc.{{ .Values.global.proxy.clusterDomain }}"
---
## To ensure all traffic to *.global is using mTLS
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: istio-multicluster-ingressgateway
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
spec:
  host: "*.global"
  {{- if .Values.global.defaultConfigVisibilitySettings }}
  exportTo:
  - '*'
  {{- end }}
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
{{- end }}
`)

func chartsGatewaysIstioIngressTemplatesPreconfiguredYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressTemplatesPreconfiguredYaml, nil
}

func chartsGatewaysIstioIngressTemplatesPreconfiguredYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressTemplatesPreconfiguredYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/templates/preconfigured.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressTemplatesRoleYaml = []byte(`{{ $gateway := index .Values "gateways" "istio-ingressgateway" }}
{{- if or $gateway.sds.enabled .Values.global.istiod.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ $gateway.name | default "istio-ingressgateway" }}-sds
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]
---
{{- end }}
`)

func chartsGatewaysIstioIngressTemplatesRoleYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressTemplatesRoleYaml, nil
}

func chartsGatewaysIstioIngressTemplatesRoleYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressTemplatesRoleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/templates/role.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressTemplatesRolebindingsYaml = []byte(`{{ $gateway := index .Values "gateways" "istio-ingressgateway" }}
{{- if or $gateway.sds.enabled .Values.global.istiod.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ $gateway.name | default "istio-ingressgateway" }}-sds
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ $gateway.name | default "istio-ingressgateway" }}-sds
subjects:
- kind: ServiceAccount
  name: {{ $gateway.name | default "istio-ingressgateway" }}-service-account
---
{{- end }}
`)

func chartsGatewaysIstioIngressTemplatesRolebindingsYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressTemplatesRolebindingsYaml, nil
}

func chartsGatewaysIstioIngressTemplatesRolebindingsYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressTemplatesRolebindingsYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/templates/rolebindings.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressTemplatesServiceYaml = []byte(`{{ $gateway := index .Values "gateways" "istio-ingressgateway" }}
{{- if not $gateway.customService }}
apiVersion: v1
kind: Service
metadata:
  name: {{ $gateway.name | default "istio-ingressgateway" }}
  namespace: {{ .Release.Namespace }}
  annotations:
    {{- range $key, $val := $gateway.serviceAnnotations }}
    {{ $key }}: {{ $val | quote }}
    {{- end }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
spec:
{{- if $gateway.loadBalancerIP }}
  loadBalancerIP: "{{ $gateway.loadBalancerIP }}"
{{- end }}
{{- if $gateway.loadBalancerSourceRanges }}
  loadBalancerSourceRanges:
{{ toYaml $gateway.loadBalancerSourceRanges | indent 4 }}
{{- end }}
{{- if $gateway.externalTrafficPolicy }}
  externalTrafficPolicy: {{$gateway.externalTrafficPolicy }}
{{- end }}
  type: {{ $gateway.type }}
  selector:
{{ $gateway.labels | toYaml | indent 4 }}
  ports:

    {{- range $key, $val := $gateway.ports }}
    -
      {{- range $pkey, $pval := $val }}
      {{ $pkey}}: {{ $pval }}
      {{- end }}
    {{- end }}

    {{- if $.Values.global.meshExpansion.enabled }}
    {{- range $key, $val := $gateway.meshExpansionPorts }}
    -
      {{- range $pkey, $pval := $val }}
      {{ $pkey}}: {{ $pval }}
      {{- end }}
    {{- end }}
    {{- end }}
  {{ range $app := $gateway.ingressPorts }}
    -
      port: {{ $app.port }}
      name: {{ $app.name }}
  {{- end }}
---
{{ end }}
`)

func chartsGatewaysIstioIngressTemplatesServiceYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressTemplatesServiceYaml, nil
}

func chartsGatewaysIstioIngressTemplatesServiceYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressTemplatesServiceYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/templates/service.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressTemplatesServiceaccountYaml = []byte(`{{ $gateway := index .Values "gateways" "istio-ingressgateway" }}
apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end }}
metadata:
  name: {{ $gateway.name | default "istio-ingressgateway" }}-service-account
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
`)

func chartsGatewaysIstioIngressTemplatesServiceaccountYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressTemplatesServiceaccountYaml, nil
}

func chartsGatewaysIstioIngressTemplatesServiceaccountYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressTemplatesServiceaccountYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/templates/serviceaccount.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressTemplatesSidecarYaml = []byte(`apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: default
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
spec:
  egress:
    - hosts:
        - "*/*"
`)

func chartsGatewaysIstioIngressTemplatesSidecarYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressTemplatesSidecarYaml, nil
}

func chartsGatewaysIstioIngressTemplatesSidecarYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressTemplatesSidecarYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/templates/sidecar.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsGatewaysIstioIngressValuesYaml = []byte(`# A-la-carte istio ingress gateway.
# Must be installed in a separate namespace, to minimize access to secrets.

gateways:
  istio-ingressgateway:
    name: istio-ingressgateway
    #
    # Secret Discovery Service (SDS) configuration for ingress gateway.
    #
    sds:
      # If true, ingress gateway fetches credentials from SDS server to handle TLS connections.
      enabled: false
      # SDS server that watches kubernetes secrets and provisions credentials to ingress gateway.
      # This server runs in the same pod as ingress gateway.
      image: node-agent-k8s
      resources:
        requests:
          cpu: 100m
          memory: 128Mi
        limits:
          cpu: 2000m
          memory: 1024Mi
    labels:
      app: istio-ingressgateway
      istio: ingressgateway
    ports:
    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
    # Note that AWS ELB will by default perform health checks on the first port
    # on this list. Setting this to the health check port will ensure that health
    # checks always work. https://github.com/istio/istio/issues/12503
    - port: 15020
      targetPort: 15020
      name: status-port
    - port: 80
      targetPort: 80
      name: http2
    - port: 443
      name: https
    - port: 15029
      targetPort: 15029
      name: kiali
    - port: 15030
      targetPort: 15030
      name: prometheus
    - port: 15031
      targetPort: 15031
      name: grafana
    - port: 15032
      targetPort: 15032
      name: tracing
    - port: 31400
      targetPort: 31400
      name: tcp
      # This is the port where sni routing happens
    - port: 15443
      targetPort: 15443
      name: tls

    # Scalability tunning
    # replicaCount: 1
    rollingMaxSurge: 100%
    rollingMaxUnavailable: 25%
    autoscaleEnabled: true
    autoscaleMin: 1
    autoscaleMax: 5

    cpu:
      targetAverageUtilization: 80

    resources:
      requests:
        cpu: 100m
        memory: 128Mi
      limits:
        cpu: 2000m
        memory: 1024Mi

    # Debug level for envoy. Can be set to 'debug'
    debug: info

    loadBalancerIP: ""
    loadBalancerSourceRanges: []
    externalIPs: []
    serviceAnnotations: {}

    domain: ""

    # Enable cross-cluster access using SNI matching
    zvpn:
      enabled: false
      suffix: global

    # To generate an internal load balancer:
    # --set serviceAnnotations.cloud.google.com/load-balancer-type=internal
    #serviceAnnotations:
    #    cloud.google.com/load-balancer-type: "internal"

    podAnnotations: {}
    type: LoadBalancer #change to NodePort, ClusterIP or LoadBalancer if need be

    #### MESH EXPANSION PORTS  ########
    # Pilot and Citadel MTLS ports are enabled in gateway - but will only redirect
    # to pilot/citadel if global.meshExpansion settings are enabled.
    # Delete these ports if mesh expansion is not enabled, to avoid
    # exposing unnecessary ports on the web.
    # You can remove these ports if you are not using mesh expansion
    meshExpansionPorts:
    - port: 15012
      targetPort: 15012
      name: tcp-istiod
    - port: 853
      targetPort: 853
      name: tcp-dns-tls
    ####### end MESH EXPANSION PORTS ######

    ##############
    secretVolumes:
    - name: ingressgateway-certs
      secretName: istio-ingressgateway-certs
      mountPath: /etc/istio/ingressgateway-certs
    - name: ingressgateway-ca-certs
      secretName: istio-ingressgateway-ca-certs
      mountPath: /etc/istio/ingressgateway-ca-certs

    # Domain name for telemetry addons
    telemetry_domain_name: ""

    customService: false
    externalTrafficPolicy: ""

    ingressPorts: []
    hosts: []
    additionalContainers: []
    configVolumes: []
    certificates: false
    tls: false

    # Telemetry addon gateways example config
    telemetry_addon_gateways:
      tracing_gateway:
        name: tracing
        port: 15032
        desPort: 80
        enabled: false
        tls: false
      kiali_gateway:
        name: kiali
        port: 15029
        desPort: 20001
        enabled: false
        tls: false
      grafana_gateway:
        name: grafana
        port: 15031
        desPort: 3000
        enabled: false
        tls: false
      prometheus_gateway:
        name: prometheus
        port: 15030
        desPort: 9090
        enabled: false
        tls: false

    # For Certmanager Issuer and Certificate generation
    # certificates: {}
    # email: ""

    ### Advanced options ############
    env:
      # A gateway with this mode ensures that pilot generates an additional
      # set of clusters for internal services but without Istio mTLS, to
      # enable cross cluster routing.
      ISTIO_META_ROUTER_MODE: "sni-dnat"

    nodeSelector: {}
    tolerations: []

    # Specify the pod anti-affinity that allows you to constrain which nodes
    # your pod is eligible to be scheduled based on labels on pods that are
    # already running on the node rather than based on labels on nodes.
    # There are currently two types of anti-affinity:
    #    "requiredDuringSchedulingIgnoredDuringExecution"
    #    "preferredDuringSchedulingIgnoredDuringExecution"
    # which denote "hard" vs. "soft" requirements, you can define your values
    # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
    # correspondingly.
    # For example:
    # podAntiAffinityLabelSelector:
    # - key: security
    #   operator: In
    #   values: S1,S2
    #   topologyKey: "kubernetes.io/hostname"
    # This pod anti-affinity rule says that the pod requires not to be scheduled
    # onto a node if that node is already running a pod with label having key
    # "security" and value "S1".
    podAntiAffinityLabelSelector: []
    podAntiAffinityTermLabelSelector: []
`)

func chartsGatewaysIstioIngressValuesYamlBytes() ([]byte, error) {
	return _chartsGatewaysIstioIngressValuesYaml, nil
}

func chartsGatewaysIstioIngressValuesYaml() (*asset, error) {
	bytes, err := chartsGatewaysIstioIngressValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/gateways/istio-ingress/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioCniChartYaml = []byte(`apiVersion: v1
name: istio-cni
version: 1.1.0
description: Helm chart for istio-cni components
keywords:
  - istio-cni
  - istio
sources:
  - http://github.com/istio/cni
engine: gotpl
icon: https://istio.io/favicons/android-192x192.png
`)

func chartsIstioCniChartYamlBytes() ([]byte, error) {
	return _chartsIstioCniChartYaml, nil
}

func chartsIstioCniChartYaml() (*asset, error) {
	bytes, err := chartsIstioCniChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-cni/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioCniTemplatesClusterroleYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-cni
  labels:
    app: istio-cni
    release: {{ .Release.Name }}
rules:
- apiGroups: [""]
  resources:
  - pods
  - nodes
  verbs:
  - get
---
{{- if .Values.cni.repair.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-cni-repair-role
  labels:
    app: istio-cni
    release: {{ .Release.Name }}
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch", "delete", "patch", "update" ]
- apiGroups: [""]
  resources: ["events"]
  verbs: ["get", "list", "watch", "delete", "patch", "update", "create" ]
{{- end }}`)

func chartsIstioCniTemplatesClusterroleYamlBytes() ([]byte, error) {
	return _chartsIstioCniTemplatesClusterroleYaml, nil
}

func chartsIstioCniTemplatesClusterroleYaml() (*asset, error) {
	bytes, err := chartsIstioCniTemplatesClusterroleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-cni/templates/clusterrole.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioCniTemplatesClusterrolebindingYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-cni
  labels:
    app: istio-cni
    release: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istio-cni
subjects:
- kind: ServiceAccount
  name: istio-cni
  namespace: {{ .Release.Namespace }}
---
{{- if .Values.cni.repair.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-cni-repair-rolebinding
  namespace: {{ .Release.Namespace}}
  labels:
    k8s-app: istio-cni-repair
subjects:
- kind: ServiceAccount
  name: istio-cni
  namespace: {{ .Release.Namespace}}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istio-cni-repair-role
{{- end }}
---
{{- if ne .Values.cni.psp_cluster_role "" }}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: istio-cni-psp
  namespace: {{ .Release.Namespace }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ .Values.cni.psp_cluster_role }}
subjects:
- kind: ServiceAccount
  name: istio-cni
  namespace: {{ .Release.Namespace }}
{{- end }}
`)

func chartsIstioCniTemplatesClusterrolebindingYamlBytes() ([]byte, error) {
	return _chartsIstioCniTemplatesClusterrolebindingYaml, nil
}

func chartsIstioCniTemplatesClusterrolebindingYaml() (*asset, error) {
	bytes, err := chartsIstioCniTemplatesClusterrolebindingYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-cni/templates/clusterrolebinding.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioCniTemplatesConfigmapCniYaml = []byte(`kind: ConfigMap
apiVersion: v1
metadata:
  name: istio-cni-config
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-cni
    release: {{ .Release.Name }}
data:
  # The CNI network configuration to add to the plugin chain on each node.  The special
  # values in this config will be automatically populated.
  cni_network_config: |-
        {
          "cniVersion": "0.3.1",
          "name": "istio-cni",
          "type": "istio-cni",
          "log_level": {{ quote .Values.cni.logLevel }},
          "kubernetes": {
              "kubeconfig": "__KUBECONFIG_FILEPATH__",
              "cni_bin_dir": {{ quote .Values.cni.cniBinDir }},
              "exclude_namespaces": [ {{ range $idx, $ns := .Values.cni.excludeNamespaces }}{{ if $idx }}, {{ end }}{{ quote $ns }}{{ end }} ]
          }
        }
`)

func chartsIstioCniTemplatesConfigmapCniYamlBytes() ([]byte, error) {
	return _chartsIstioCniTemplatesConfigmapCniYaml, nil
}

func chartsIstioCniTemplatesConfigmapCniYaml() (*asset, error) {
	bytes, err := chartsIstioCniTemplatesConfigmapCniYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-cni/templates/configmap-cni.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioCniTemplatesDaemonsetYaml = []byte(`# This manifest installs the Istio install-cni container, as well
# as the Istio CNI plugin and config on
# each master and worker node in a Kubernetes cluster.
kind: DaemonSet
apiVersion: apps/v1
metadata:
  name: istio-cni-node
  namespace: {{ .Release.Namespace }}
  labels:
    k8s-app: istio-cni-node
    release: {{ .Release.Name }}
spec:
  selector:
    matchLabels:
      k8s-app: istio-cni-node
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
  template:
    metadata:
      labels:
        k8s-app: istio-cni-node
      annotations:
        # This, along with the CriticalAddonsOnly toleration below,
        # marks the pod as a critical add-on, ensuring it gets
        # priority scheduling and that its resources are reserved
        # if it ever gets evicted.
        scheduler.alpha.kubernetes.io/critical-pod: ''
        {{- if .Values.cni.podAnnotations }}
{{ toYaml .Values.cni.podAnnotations | indent 8 }}
        {{- end }}
    spec:
      nodeSelector:
        beta.kubernetes.io/os: linux
      hostNetwork: true
      tolerations:
        # Make sure istio-cni-node gets scheduled on all nodes.
        - effect: NoSchedule
          operator: Exists
        # Mark the pod as a critical add-on for rescheduling.
        - key: CriticalAddonsOnly
          operator: Exists
        - effect: NoExecute
          operator: Exists
      priorityClassName: system-cluster-critical
      serviceAccountName: istio-cni
      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
      terminationGracePeriodSeconds: 5
      containers:
        # This container installs the Istio CNI binaries
        # and CNI network config file on each node.
        - name: install-cni
{{- if contains "/" .Values.cni.image }}
          image: "{{ .Values.cni.image }}"
{{- else }}
          image: "{{ .Values.cni.hub | default .Values.global.hub }}/{{ .Values.cni.image | default "install-cni" }}:{{ .Values.cni.tag | default .Values.global.tag }}"
{{- end }}
          imagePullPolicy: {{ .Values.cni.pullPolicy | default .Values.global.imagePullPolicy }}
          command: ["/install-cni.sh"]
          env:
{{- if .Values.cni.cniConfFileName }}
            # Name of the CNI config file to create.
            - name: CNI_CONF_NAME
              value: "{{ .Values.cni.cniConfFileName }}"
{{- end }}
            # The CNI network config to install on each node.
            - name: CNI_NETWORK_CONFIG
              valueFrom:
                configMapKeyRef:
                  name: istio-cni-config
                  key: cni_network_config
            - name: CNI_NET_DIR
              value: {{ default "/etc/cni/net.d" .Values.cni.cniConfDir }}
            # Deploy as a standalone CNI plugin or as chained?
            - name: CHAINED_CNI_PLUGIN
              value: "{{ .Values.cni.chained }}"
          volumeMounts:
            - mountPath: /host/opt/cni/bin
              name: cni-bin-dir
            - mountPath: /host/etc/cni/net.d
              name: cni-net-dir
{{- if .Values.cni.repair.enabled }}
        - name: repair-cni
{{- if contains "/" .Values.cni.image }}
          image: "{{ .Values.cni.image }}"
{{- else }}
          image: "{{ .Values.cni.hub | default .Values.global.hub }}/{{ .Values.cni.image | default "install-cni" }}:{{ .Values.cni.tag | default .Values.global.tag }}"
{{- end }}
{{- if or .Values.cni.pullPolicy .Values.global.imagePullPolicy }}
          imagePullPolicy: {{ .Values.cni.pullPolicy | default .Values.global.imagePullPolicy }}
{{- end }}

          command: ["/opt/cni/bin/istio-cni-repair"]
          env:
          - name: "REPAIR_NODE-NAME"
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: "REPAIR_LABEL-PODS"
            value: "{{.Values.cni.repair.labelPods}}"
          # Set to true to enable pod deletion
          - name: "REPAIR_DELETE-PODS"
            value: "{{.Values.cni.repair.deletePods}}"
          - name: "REPAIR_RUN-AS-DAEMON"
            value: "true"
          - name: "REPAIR_SIDECAR-ANNOTATION"
            value: "sidecar.istio.io/status"
          - name: "REPAIR_INIT-CONTAINER-NAME"
            value: "{{ .Values.cni.repair.initContainerName }}"
          - name: "REPAIR_BROKEN-POD-LABEL-KEY"
            value: "{{.Values.cni.repair.brokenPodLabelKey}}"
          - name: "REPAIR_BROKEN-POD-LABEL-VALUE"
            value: "{{.Values.cni.repair.brokenPodLabelValue}}"
{{- end }}
      volumes:
        # Used to install CNI.
        - name: cni-bin-dir
          hostPath:
            path: {{ default "/opt/cni/bin" .Values.cni.cniBinDir }}
        - name: cni-net-dir
          hostPath:
            path: {{ default "/etc/cni/net.d" .Values.cni.cniConfDir }}
`)

func chartsIstioCniTemplatesDaemonsetYamlBytes() ([]byte, error) {
	return _chartsIstioCniTemplatesDaemonsetYaml, nil
}

func chartsIstioCniTemplatesDaemonsetYaml() (*asset, error) {
	bytes, err := chartsIstioCniTemplatesDaemonsetYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-cni/templates/daemonset.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioCniTemplatesServiceaccountYaml = []byte(`apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end }}
metadata:
  name: istio-cni
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-cni
    release: {{ .Release.Name }}
`)

func chartsIstioCniTemplatesServiceaccountYamlBytes() ([]byte, error) {
	return _chartsIstioCniTemplatesServiceaccountYaml, nil
}

func chartsIstioCniTemplatesServiceaccountYaml() (*asset, error) {
	bytes, err := chartsIstioCniTemplatesServiceaccountYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-cni/templates/serviceaccount.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioCniValuesYaml = []byte(`cni:
  hub: ""
  tag: ""
  image: install-cni
  pullPolicy: Always

  logLevel: info

  # Configuration file to insert istio-cni plugin configuration
  # by default this will be the first file found in the cni-conf-dir
  # Example
  # cniConfFileName: 10-calico.conflist

  # CNI bin and conf dir override settings
  # defaults:
  cniBinDir: /opt/cni/bin
  cniConfDir: /etc/cni/net.d
  cniConfFileName: ""

  excludeNamespaces:
    - istio-system

  # Custom annotations on pod level, if you need them
  podAnnotations: {}

  # If this value is set a RoleBinding will be created
  # in the same namespace as the istio-cni DaemonSet is created.
  # This can be used to bind a preexisting ClusterRole to the istio/cni ServiceAccount
  # e.g. if you use PodSecurityPolicies
  psp_cluster_role: ""

  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
  chained: true

  repair:
    enabled: true
    hub: ""
    tag: ""

    labelPods: true
    deletePods: true

    initContainerName: "istio-validation"

    brokenPodLabelKey: "cni.istio.io/uninitialized"
    brokenPodLabelValue: "true"
`)

func chartsIstioCniValuesYamlBytes() ([]byte, error) {
	return _chartsIstioCniValuesYaml, nil
}

func chartsIstioCniValuesYaml() (*asset, error) {
	bytes, err := chartsIstioCniValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-cni/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioAutoinjectChartYaml = []byte(`apiVersion: v1
name: istio-autoinject
version: 1.1.0
appVersion: 1.1.0
tillerVersion: ">=2.7.2"
description: Helm chart for sidecar injector webhook deployment
keywords:
  - istio
  - sidecarInjectorWebhook
  - autoinject
sources:
  - http://github.com/istio/istio
engine: gotpl
icon: https://istio.io/favicons/android-192x192.png
`)

func chartsIstioControlIstioAutoinjectChartYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioAutoinjectChartYaml, nil
}

func chartsIstioControlIstioAutoinjectChartYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioAutoinjectChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-autoinject/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioAutoinjectNotesTxt = []byte(`Sidecar injector (optional): if disabled, manual injection or other tools need to be used.

Sidecar injection in each profile can be selected by labeling the namespace with the appropriate profile.

The new label is 'istio-env' and the value is the namespace where the injector is installed.

Note that it is possible to install a profile with only the injector app - using remote Pilot and MCP.

`+"`"+``+"`"+``+"`"+`
    # New style, using the istio-pilot11 profile
    kubectl create ns fortio
    kubectl label ns fortio istio-env=istio-control

    # Second pilot profile
    kubectl create ns fortio-test
    kubectl label ns fortio istio-env=istio-master

    # Old-style, using istio-system and Istio 1.0 or 1.1 default installations.
    kubectl create ns fortio-istio-system
    kubectl label ns fortio istio-injection=enabled
`+"`"+``+"`"+``+"`"+`

# Uninstall

After uninstalling, you should cleanup the global CRD using:

`+"`"+``+"`"+``+"`"+`bash

  kubectl delete MutatingWebhookConfiguration istio-sidecar-injector-istio-control

`+"`"+``+"`"+``+"`"+`

Any app using the uninstalled istio-env label will no longer be auto-injected once the config is deleted.
`)

func chartsIstioControlIstioAutoinjectNotesTxtBytes() ([]byte, error) {
	return _chartsIstioControlIstioAutoinjectNotesTxt, nil
}

func chartsIstioControlIstioAutoinjectNotesTxt() (*asset, error) {
	bytes, err := chartsIstioControlIstioAutoinjectNotesTxtBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-autoinject/NOTES.txt", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioAutoinjectFilesInjectionTemplateYaml = []byte(`template: |
  rewriteAppHTTPProbe: {{ valueOrDefault .Values.sidecarInjectorWebhook.rewriteAppHTTPProbe true }}
  initContainers:
  {{ if ne (annotation .ObjectMeta `+"`"+`sidecar.istio.io/interceptionMode`+"`"+` .ProxyConfig.InterceptionMode) `+"`"+`NONE`+"`"+` }}
  {{ if .Values.istio_cni.enabled -}}
  - name: istio-validation
  {{ else -}}
  - name: istio-init
  {{ end -}}
  {{- if contains "/" .Values.global.proxy_init.image }}
    image: "{{ .Values.global.proxy_init.image }}"
  {{- else }}
    image: "{{ .Values.global.hub }}/{{ .Values.global.proxy_init.image }}:{{ .Values.global.tag }}"
  {{- end }}
    command:
    - istio-iptables
    - "-p"
    - 15001
    - "-z"
    - "15006"
    - "-u"
    - 1337
    - "-m"
    - "{{ annotation .ObjectMeta `+"`"+`sidecar.istio.io/interceptionMode`+"`"+` .ProxyConfig.InterceptionMode }}"
    - "-i"
    - "{{ annotation .ObjectMeta `+"`"+`traffic.sidecar.istio.io/includeOutboundIPRanges`+"`"+` .Values.global.proxy.includeIPRanges }}"
    - "-x"
    - "{{ annotation .ObjectMeta `+"`"+`traffic.sidecar.istio.io/excludeOutboundIPRanges`+"`"+` .Values.global.proxy.excludeIPRanges }}"
    - "-b"
    - "{{ annotation .ObjectMeta `+"`"+`traffic.sidecar.istio.io/includeInboundPorts`+"`"+` `+"`"+`*`+"`"+` }}"
    - "-d"
    - "{{ excludeInboundPort (annotation .ObjectMeta `+"`"+`status.sidecar.istio.io/port`+"`"+` .Values.global.proxy.statusPort) (annotation .ObjectMeta `+"`"+`traffic.sidecar.istio.io/excludeInboundPorts`+"`"+` .Values.global.proxy.excludeInboundPorts) }}"
    {{ if or (isset .ObjectMeta.Annotations `+"`"+`traffic.sidecar.istio.io/excludeOutboundPorts`+"`"+`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
    - "-o"
    - "{{ annotation .ObjectMeta `+"`"+`traffic.sidecar.istio.io/excludeOutboundPorts`+"`"+` .Values.global.proxy.excludeOutboundPorts }}"
    {{ end -}}
    {{ if (isset .ObjectMeta.Annotations `+"`"+`traffic.sidecar.istio.io/kubevirtInterfaces`+"`"+`) -}}
    - "-k"
    - "{{ index .ObjectMeta.Annotations `+"`"+`traffic.sidecar.istio.io/kubevirtInterfaces`+"`"+` }}"
    {{ end -}}
    {{ if .Values.istio_cni.enabled -}}
    - "--run-validation"
    - "--skip-rule-apply"
    {{ end -}}
    imagePullPolicy: "{{ valueOrDefault .Values.global.imagePullPolicy `+"`"+`Always`+"`"+` }}"
  {{- if .Values.global.proxy_init.resources }}
    resources:
      {{ toYaml .Values.global.proxy_init.resources | indent 4 }}
  {{- else }}
    resources: {}
  {{- end }}
    securityContext:
      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
      privileged: {{ .Values.global.proxy.privileged }}
      capabilities:
    {{- if not .Values.istio_cni.enabled }}
        add:
        - NET_ADMIN
        - NET_RAW
    {{- end }}
        drop:
        - ALL
    {{- if not .Values.istio_cni.enabled }}
      readOnlyRootFilesystem: false
      runAsGroup: 0
      runAsNonRoot: false
      runAsUser: 0
    {{- else }}
      readOnlyRootFilesystem: true
      runAsGroup: 1337
      runAsUser: 1337
      runAsNonRoot: true
    {{- end }}
    restartPolicy: Always
  {{ end -}}
  {{- if eq .Values.global.proxy.enableCoreDump true }}
  - name: enable-core-dump
    args:
    - -c
    - sysctl -w kernel.core_pattern=/var/lib/istio/core.proxy && ulimit -c unlimited
    command:
      - /bin/sh
  {{- if contains "/" .Values.global.proxy_init.image }}
    image: "{{ .Values.global.proxy_init.image }}"
  {{- else }}
    image: "{{ .Values.global.hub }}/{{ .Values.global.proxy_init.image }}:{{ .Values.global.tag }}"
  {{- end }}
    imagePullPolicy: "{{ valueOrDefault .Values.global.imagePullPolicy `+"`"+`Always`+"`"+` }}"
    resources: {}
    securityContext:
      allowPrivilegeEscalation: true
      capabilities:
        add:
        - SYS_ADMIN
        drop:
        - ALL
      privileged: true
      readOnlyRootFilesystem: false
      runAsGroup: 0
      runAsNonRoot: false
      runAsUser: 0
  {{ end }}
  containers:
  - name: istio-proxy
  {{- if contains "/" (annotation .ObjectMeta `+"`"+`sidecar.istio.io/proxyImage`+"`"+` .Values.global.proxy.image) }}
    image: "{{ annotation .ObjectMeta `+"`"+`sidecar.istio.io/proxyImage`+"`"+` .Values.global.proxy.image }}"
  {{- else }}
    image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}"
  {{- end }}
    ports:
    - containerPort: 15090
      protocol: TCP
      name: http-envoy-prom
    args:
    - proxy
    - sidecar
    - --domain
    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
    - --configPath
    - "/etc/istio/proxy"
    - --binaryPath
    - "/usr/local/bin/envoy"
    - --serviceCluster
    {{ if ne "" (index .ObjectMeta.Labels "app") -}}
    - "{{ index .ObjectMeta.Labels `+"`"+`app`+"`"+` }}.$(POD_NAMESPACE)"
    {{ else -}}
    - "{{ valueOrDefault .DeploymentMeta.Name `+"`"+`istio-proxy`+"`"+` }}.{{ valueOrDefault .DeploymentMeta.Namespace `+"`"+`default`+"`"+` }}"
    {{ end -}}
    - --drainDuration
    - "{{ formatDuration .ProxyConfig.DrainDuration }}"
    - --parentShutdownDuration
    - "{{ formatDuration .ProxyConfig.ParentShutdownDuration }}"
    - --discoveryAddress
    - "{{ annotation .ObjectMeta `+"`"+`sidecar.istio.io/discoveryAddress`+"`"+` .ProxyConfig.DiscoveryAddress }}"
  {{- if eq .Values.global.proxy.tracer "lightstep" }}
    - --lightstepAddress
    - "{{ .ProxyConfig.GetTracing.GetLightstep.GetAddress }}"
    - --lightstepAccessToken
    - "{{ .ProxyConfig.GetTracing.GetLightstep.GetAccessToken }}"
    - --lightstepSecure={{ .ProxyConfig.GetTracing.GetLightstep.GetSecure }}
    - --lightstepCacertPath
    - "{{ .ProxyConfig.GetTracing.GetLightstep.GetCacertPath }}"
  {{- else if eq .Values.global.proxy.tracer "zipkin" }}
    - --zipkinAddress
    - "{{ .ProxyConfig.GetTracing.GetZipkin.GetAddress }}"
  {{- else if eq .Values.global.proxy.tracer "datadog" }}
    - --datadogAgentAddress
    - "{{ .ProxyConfig.GetTracing.GetDatadog.GetAddress }}"
  {{- end }}
    - --proxyLogLevel={{ annotation .ObjectMeta `+"`"+`sidecar.istio.io/logLevel`+"`"+` .Values.global.proxy.logLevel}}
    - --proxyComponentLogLevel={{ annotation .ObjectMeta `+"`"+`sidecar.istio.io/componentLogLevel`+"`"+` .Values.global.proxy.componentLogLevel}}
    - --connectTimeout
    - "{{ formatDuration .ProxyConfig.ConnectTimeout }}"
  {{- if .Values.global.proxy.envoyStatsd.enabled }}
    - --statsdUdpAddress
    - "{{ .ProxyConfig.StatsdUdpAddress }}"
  {{- end }}
  {{- if .Values.global.proxy.envoyMetricsService.enabled }}
    - --envoyMetricsService
    - '{{ protoToJSON .ProxyConfig.EnvoyMetricsService }}'
  {{- end }}
  {{- if .Values.global.proxy.envoyAccessLogService.enabled }}
    - --envoyAccessLogService
    - '{{ protoToJSON .ProxyConfig.EnvoyAccessLogService }}'
  {{- end }}
    - --proxyAdminPort
    - "{{ .ProxyConfig.ProxyAdminPort }}"
    {{ if gt .ProxyConfig.Concurrency 0 -}}
    - --concurrency
    - "{{ .ProxyConfig.Concurrency }}"
    {{ end -}}
    {{- if .Values.global.controlPlaneSecurityEnabled }}
    - --controlPlaneAuthPolicy
    - MUTUAL_TLS
    {{- else }}
    - --controlPlaneAuthPolicy
    - NONE
    {{- end }}
    - --dnsRefreshRate
    - {{ valueOrDefault .Values.global.proxy.dnsRefreshRate "300s" }}
  {{- if (ne (annotation .ObjectMeta "status.sidecar.istio.io/port" .Values.global.proxy.statusPort) "0") }}
    - --statusPort
    - "{{ annotation .ObjectMeta `+"`"+`status.sidecar.istio.io/port`+"`"+` .Values.global.proxy.statusPort }}"
  {{- end }}
  {{- if .Values.global.trustDomain }}
    - --trust-domain={{ .Values.global.trustDomain }}
  {{- end }}
  {{- if .Values.global.logAsJson }}
    - --log_as_json
  {{- end }}
  {{- if .Values.global.proxy.lifecycle }}
    lifecycle:
      {{ toYaml .Values.global.proxy.lifecycle | indent 4 }}
    {{- end }}
    env:
    - name: JWT_POLICY
      value: {{ .Values.global.jwtPolicy }}
    - name: POD_NAME
      valueFrom:
        fieldRef:
          fieldPath: metadata.name
    - name: POD_NAMESPACE
      valueFrom:
        fieldRef:
          fieldPath: metadata.namespace
    - name: INSTANCE_IP
      valueFrom:
        fieldRef:
          fieldPath: status.podIP
    - name: SERVICE_ACCOUNT
      valueFrom:
        fieldRef:
          fieldPath: spec.serviceAccountName
    - name: HOST_IP
      valueFrom:
        fieldRef:
          fieldPath: status.hostIP
  {{- if eq .Values.global.proxy.tracer "datadog" }}
  {{- if isset .ObjectMeta.Annotations `+"`"+`apm.datadoghq.com/env`+"`"+` }}
  {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `+"`"+`apm.datadoghq.com/env`+"`"+`) }}
    - name: {{ $key }}
      value: "{{ $value }}"
  {{- end }}
  {{- end }}
  {{- end }}
    - name: ISTIO_META_POD_PORTS
      value: |-
        [
        {{- $first := true }}
        {{- range $index1, $c := .Spec.Containers }}
          {{- range $index2, $p := $c.Ports }}
            {{- if (structToJSON $p) }}
            {{if not $first}},{{end}}{{ structToJSON $p }}
            {{- $first = false }}
            {{- end }}
          {{- end}}
        {{- end}}
        ]
    - name: ISTIO_META_APP_CONTAINERS
      value: |-
        [
          {{- range $index, $container := .Spec.Containers }}
            {{- if ne $index 0}},{{- end}}
            {{ $container.Name }}
          {{- end}}
        ]
    - name: ISTIO_META_CLUSTER_ID
      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `+"`"+`Kubernetes`+"`"+` }}"
    - name: ISTIO_META_POD_NAME
      valueFrom:
        fieldRef:
          fieldPath: metadata.name
    - name: ISTIO_META_CONFIG_NAMESPACE
      valueFrom:
        fieldRef:
          fieldPath: metadata.namespace
    - name: ISTIO_META_INTERCEPTION_MODE
      value: "{{ or (index .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/interceptionMode`+"`"+`) .ProxyConfig.InterceptionMode.String }}"
    {{- if .Values.global.network }}
    - name: ISTIO_META_NETWORK
      value: "{{ .Values.global.network }}"
    {{- end }}
    {{ if .ObjectMeta.Annotations }}
    - name: ISTIO_METAJSON_ANNOTATIONS
      value: |
             {{ toJSON .ObjectMeta.Annotations }}
    {{ end }}
    {{ if .ObjectMeta.Labels }}
    - name: ISTIO_METAJSON_LABELS
      value: |
             {{ toJSON .ObjectMeta.Labels }}
    {{ end }}
    {{- if .DeploymentMeta.Name }}
    - name: ISTIO_META_WORKLOAD_NAME
      value: {{ .DeploymentMeta.Name }}
    {{ end }}
    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
    - name: ISTIO_META_OWNER
      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `+"`"+`default`+"`"+` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
    {{- end}}
    {{- if (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/bootstrapOverride`+"`"+`) }}
    - name: ISTIO_BOOTSTRAP_OVERRIDE
      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
    {{- end }}
    {{- if .Values.global.sds.customTokenDirectory }}
    - name: ISTIO_META_SDS_TOKEN_PATH
      value: "{{ .Values.global.sds.customTokenDirectory -}}/sdstoken"
    {{- end }}
    {{- if .Values.global.meshID }}
    - name: ISTIO_META_MESH_ID
      value: "{{ .Values.global.meshID }}"
    {{- else if .Values.global.trustDomain }}
    - name: ISTIO_META_MESH_ID
      value: "{{ .Values.global.trustDomain }}"
    {{- end }}
    {{- if eq .Values.global.proxy.tracer "stackdriver" }}
    - name: STACKDRIVER_TRACING_ENABLED
      value: "true"
    - name: STACKDRIVER_TRACING_DEBUG
      value: "{{ .ProxyConfig.GetTracing.GetStackdriver.GetDebug }}"
    - name: STACKDRIVER_TRACING_MAX_NUMBER_OF_ANNOTATIONS
      value: "{{ .ProxyConfig.GetTracing.GetStackdriver.GetMaxNumberOfAnnotations }}"
    - name: STACKDRIVER_TRACING_MAX_NUMBER_OF_ATTRIBUTES
      value: "{{ .ProxyConfig.GetTracing.GetStackdriver.GetMaxNumberOfAttributes }}"
    - name: STACKDRIVER_TRACING_MAX_NUMBER_OF_MESSAGE_EVENTS
      value: "{{ .ProxyConfig.GetTracing.GetStackdriver.GetMaxNumberOfMessageEvents }}"
    {{- end }}
    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `+"`"+`apm.datadoghq.com/env`+"`"+`) }}
    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `+"`"+`apm.datadoghq.com/env`+"`"+`) }}
      - name: {{ $key }}
        value: "{{ $value }}"
    {{- end }}
    {{- end }}
    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
    - name: {{ $key }}
      value: "{{ $value }}"
    {{- end }}
    imagePullPolicy: "{{ valueOrDefault .Values.global.imagePullPolicy `+"`"+`Always`+"`"+` }}"
    {{ if ne (annotation .ObjectMeta `+"`"+`status.sidecar.istio.io/port`+"`"+` .Values.global.proxy.statusPort) `+"`"+`0`+"`"+` }}
    readinessProbe:
      httpGet:
        path: /healthz/ready
        port: {{ annotation .ObjectMeta `+"`"+`status.sidecar.istio.io/port`+"`"+` .Values.global.proxy.statusPort }}
      initialDelaySeconds: {{ annotation .ObjectMeta `+"`"+`readiness.status.sidecar.istio.io/initialDelaySeconds`+"`"+` .Values.global.proxy.readinessInitialDelaySeconds }}
      periodSeconds: {{ annotation .ObjectMeta `+"`"+`readiness.status.sidecar.istio.io/periodSeconds`+"`"+` .Values.global.proxy.readinessPeriodSeconds }}
      failureThreshold: {{ annotation .ObjectMeta `+"`"+`readiness.status.sidecar.istio.io/failureThreshold`+"`"+` .Values.global.proxy.readinessFailureThreshold }}
    {{ end -}}
    securityContext:
      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
      capabilities:
        {{ if or (eq (annotation .ObjectMeta `+"`"+`sidecar.istio.io/interceptionMode`+"`"+` .ProxyConfig.InterceptionMode) `+"`"+`TPROXY`+"`"+`) (eq (annotation .ObjectMeta `+"`"+`sidecar.istio.io/capNetBindService`+"`"+` .Values.global.proxy.capNetBindService) `+"`"+`true`+"`"+`) -}}
        add:
        {{ if eq (annotation .ObjectMeta `+"`"+`sidecar.istio.io/interceptionMode`+"`"+` .ProxyConfig.InterceptionMode) `+"`"+`TPROXY`+"`"+` -}}
        - NET_ADMIN
        {{- end }}
        {{ if eq (annotation .ObjectMeta `+"`"+`sidecar.istio.io/capNetBindService`+"`"+` .Values.global.proxy.capNetBindService) `+"`"+`true`+"`"+` -}}
        - NET_BIND_SERVICE
        {{- end }}
        {{- end }}
        drop:
        - ALL
      privileged: {{ .Values.global.proxy.privileged }}
      readOnlyRootFilesystem: {{ not .Values.global.proxy.enableCoreDump }}
      runAsGroup: 1337
      {{ if or (eq (annotation .ObjectMeta `+"`"+`sidecar.istio.io/interceptionMode`+"`"+` .ProxyConfig.InterceptionMode) `+"`"+`TPROXY`+"`"+`) (eq (annotation .ObjectMeta `+"`"+`sidecar.istio.io/capNetBindService`+"`"+` .Values.global.proxy.capNetBindService) `+"`"+`true`+"`"+`) -}}
      runAsNonRoot: false
      runAsUser: 0
      {{- else -}}
      runAsNonRoot: true
      runAsUser: 1337
      {{- end }}
    resources:
  {{- if or (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyCPU`+"`"+`) (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyMemory`+"`"+`) (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyCPULimit`+"`"+`) (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyMemoryLimit`+"`"+`) }}
    {{- if or (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyCPU`+"`"+`) (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyMemory`+"`"+`) }}
      requests:
        {{ if (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyCPU`+"`"+`) -}}
        cpu: "{{ index .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyCPU`+"`"+` }}"
        {{ end }}
        {{ if (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyMemory`+"`"+`) -}}
        memory: "{{ index .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyMemory`+"`"+` }}"
        {{ end }}
    {{- end }}
    {{- if or (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyCPULimit`+"`"+`) (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyMemoryLimit`+"`"+`) }}
      limits:
        {{ if (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyCPULimit`+"`"+`) -}}
        cpu: "{{ index .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyCPULimit`+"`"+` }}"
        {{ end }}
        {{ if (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyMemoryLimit`+"`"+`) -}}
        memory: "{{ index .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyMemoryLimit`+"`"+` }}"
        {{ end }}
    {{- end }}
  {{- else }}
    {{- if .Values.global.proxy.resources }}
      {{ toYaml .Values.global.proxy.resources | indent 4 }}
    {{- end }}
  {{- end }}
    volumeMounts:
    {{ if (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/bootstrapOverride`+"`"+`) }}
    - mountPath: /etc/istio/custom-bootstrap
      name: custom-bootstrap-volume
    {{- end }}
    - mountPath: /etc/istio/proxy
      name: istio-envoy
    - mountPath: /etc/certs/
      name: istio-certs
      readOnly: true
    {{- if and (eq .Values.global.proxy.tracer "lightstep") .Values.global.tracer.lightstep.cacertPath }}
    - mountPath: {{ directory .ProxyConfig.GetTracing.GetLightstep.GetCacertPath }}
      name: lightstep-certs
      readOnly: true
    {{- end }}
      {{- if isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/userVolumeMount`+"`"+` }}
      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/userVolumeMount`+"`"+`) }}
    - name: "{{  $index }}"
      {{ toYaml $value | indent 4 }}
      {{ end }}
      {{- end }}
  volumes:
  {{- if (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/bootstrapOverride`+"`"+`) }}
  - name: custom-bootstrap-volume
    configMap:
      name: {{ annotation .ObjectMeta `+"`"+`sidecar.istio.io/bootstrapOverride`+"`"+` "" }}
  {{- end }}
  - emptyDir:
      medium: Memory
    name: istio-envoy
  - name: istio-certs
    secret:
      optional: true
      {{ if eq .Spec.ServiceAccountName "" }}
      secretName: istio.default
      {{ else -}}
      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
      {{  end -}}
    {{- if isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/userVolume`+"`"+` }}
    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/userVolume`+"`"+`) }}
  - name: "{{ $index }}"
    {{ toYaml $value | indent 2 }}
    {{ end }}
    {{ end }}
  {{- if and (eq .Values.global.proxy.tracer "lightstep") .Values.global.tracer.lightstep.cacertPath }}
  - name: lightstep-certs
    secret:
      optional: true
      secretName: lightstep.cacert
  {{- end }}
  {{- if .Values.global.podDNSSearchNamespaces }}
  dnsConfig:
    searches:
      {{- range .Values.global.podDNSSearchNamespaces }}
      - {{ render . }}
      {{- end }}
  {{- end }}
`)

func chartsIstioControlIstioAutoinjectFilesInjectionTemplateYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioAutoinjectFilesInjectionTemplateYaml, nil
}

func chartsIstioControlIstioAutoinjectFilesInjectionTemplateYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioAutoinjectFilesInjectionTemplateYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-autoinject/files/injection-template.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioAutoinjectTemplates_affinityTpl = []byte(`{{/* affinity - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ */}}

{{- define "nodeaffinity" }}
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityRequiredDuringScheduling" . }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityPreferredDuringScheduling" . }}
{{- end }}

{{- define "nodeAffinityRequiredDuringScheduling" }}
      nodeSelectorTerms:
      - matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
        {{- range $key, $val := .Values.global.arch }}
          {{- if gt ($val | int) 0 }}
          - {{ $key | quote }}
          {{- end }}
        {{- end }}
        {{- $nodeSelector := default .Values.global.defaultNodeSelector .Values.sidecarInjectorWebhook.nodeSelector -}}
        {{- range $key, $val := $nodeSelector }}
        - key: {{ $key }}
          operator: In
          values:
          - {{ $val | quote }}
        {{- end }}
{{- end }}

{{- define "nodeAffinityPreferredDuringScheduling" }}
  {{- range $key, $val := .Values.global.arch }}
    {{- if gt ($val | int) 0 }}
    - weight: {{ $val | int }}
      preference:
        matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
          - {{ $key | quote }}
    {{- end }}
  {{- end }}
{{- end }}

{{- define "podAntiAffinity" }}
{{- if or .Values.sidecarInjectorWebhook.podAntiAffinityLabelSelector .Values.sidecarInjectorWebhook.podAntiAffinityTermLabelSelector}}
  podAntiAffinity:
    {{- if .Values.sidecarInjectorWebhook.podAntiAffinityLabelSelector }}
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityRequiredDuringScheduling" . }}
    {{- end }}
    {{- if .Values.sidecarInjectorWebhook.podAntiAffinityTermLabelSelector }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityPreferredDuringScheduling" . }}
    {{- end }}
{{- end }}
{{- end }}

{{- define "podAntiAffinityRequiredDuringScheduling" }}
    {{- range $index, $item := .Values.sidecarInjectorWebhook.podAntiAffinityLabelSelector }}
    - labelSelector:
        matchExpressions:
        - key: {{ $item.key }}
          operator: {{ $item.operator }}
          {{- if $item.values }}
          values:
          {{- $vals := split "," $item.values }}
          {{- range $i, $v := $vals }}
          - {{ $v | quote }}
          {{- end }}
          {{- end }}
      topologyKey: {{ $item.topologyKey }}
    {{- end }}
{{- end }}

{{- define "podAntiAffinityPreferredDuringScheduling" }}
    {{- range $index, $item := .Values.sidecarInjectorWebhook.podAntiAffinityTermLabelSelector }}
    - podAffinityTerm:
        labelSelector:
          matchExpressions:
          - key: {{ $item.key }}
            operator: {{ $item.operator }}
            {{- if $item.values }}
            values:
            {{- $vals := split "," $item.values }}
            {{- range $i, $v := $vals }}
            - {{ $v | quote }}
            {{- end }}
            {{- end }}
        topologyKey: {{ $item.topologyKey }}
      weight: 100
    {{- end }}
{{- end }}
`)

func chartsIstioControlIstioAutoinjectTemplates_affinityTplBytes() ([]byte, error) {
	return _chartsIstioControlIstioAutoinjectTemplates_affinityTpl, nil
}

func chartsIstioControlIstioAutoinjectTemplates_affinityTpl() (*asset, error) {
	bytes, err := chartsIstioControlIstioAutoinjectTemplates_affinityTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-autoinject/templates/_affinity.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioAutoinjectTemplates_helpersTpl = []byte(`{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "sidecar-injector.name" -}}
{{- default .Chart.Name .Values.sidecarInjectorWebhook.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "sidecar-injector.fullname" -}}
{{- if .Values.sidecarInjectorWebhook.fullnameOverride -}}
{{- .Values.sidecarInjectorWebhook.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.sidecarInjectorWebhook.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "sidecar-injector.chart" -}}
{{- .Chart.Name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
`)

func chartsIstioControlIstioAutoinjectTemplates_helpersTplBytes() ([]byte, error) {
	return _chartsIstioControlIstioAutoinjectTemplates_helpersTpl, nil
}

func chartsIstioControlIstioAutoinjectTemplates_helpersTpl() (*asset, error) {
	bytes, err := chartsIstioControlIstioAutoinjectTemplates_helpersTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-autoinject/templates/_helpers.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioAutoinjectTemplatesClusterroleYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-sidecar-injector-{{ .Release.Namespace }}
  labels:
    app: sidecar-injector
    release: {{ .Release.Name }}
    istio: sidecar-injector
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  resourceNames: ["istio-sidecar-injector"]
  verbs: ["get", "list", "watch"]
{{- if not .Values.global.operatorManageWebhooks }}
- apiGroups: ["admissionregistration.k8s.io"]
  resources: ["mutatingwebhookconfigurations"]
  resourceNames: ["istio-sidecar-injector", "istio-sidecar-injector-{{.Release.Namespace}}"]
  verbs: ["get", "list", "watch", "patch"]
{{- end }}`)

func chartsIstioControlIstioAutoinjectTemplatesClusterroleYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioAutoinjectTemplatesClusterroleYaml, nil
}

func chartsIstioControlIstioAutoinjectTemplatesClusterroleYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioAutoinjectTemplatesClusterroleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-autoinject/templates/clusterrole.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioAutoinjectTemplatesClusterrolebindingYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-sidecar-injector-admin-role-binding-{{ .Release.Namespace }}
  labels:
    app: sidecar-injector
    release: {{ .Release.Name }}
    istio: sidecar-injector
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istio-sidecar-injector-{{ .Release.Namespace }}
subjects:
  - kind: ServiceAccount
    name: istio-sidecar-injector-service-account
    namespace: {{ .Release.Namespace }}
`)

func chartsIstioControlIstioAutoinjectTemplatesClusterrolebindingYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioAutoinjectTemplatesClusterrolebindingYaml, nil
}

func chartsIstioControlIstioAutoinjectTemplatesClusterrolebindingYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioAutoinjectTemplatesClusterrolebindingYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-autoinject/templates/clusterrolebinding.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioAutoinjectTemplatesConfigmapYaml = []byte(`apiVersion: v1
kind: ConfigMap
metadata:
  name: injector-mesh
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
data:
  # This is the 'mesh' config, loaded by the sidecar injector.
  # It is a different configmap from pilot to allow a-la-carte install of the injector and follow the model
  # of reducing blast-radius of config changes and avoiding globals.

  # Note that injector uses a subset of the mesh config only - for clarity this is only generating the
  # required config, i.e. the defaultConfig section. See injection-template .ProxyConfig settings.


  mesh: |-
    # Unix Domain Socket through which envoy communicates with NodeAgent SDS to get
    # key/cert for mTLS. Use secret-mount files instead of SDS if set to empty.
    sdsUdsPath: {{ .Values.global.sds.udsPath | quote }}

    defaultConfig:
      #
      # TCP connection timeout between Envoy & the application, and between Envoys.
      connectTimeout: 10s
      #
      ### ADVANCED SETTINGS #############
      # Where should envoy's configuration be stored in the istio-proxy container
      configPath: "/etc/istio/proxy"
      # The pseudo service name used for Envoy.
      serviceCluster: istio-proxy
      # These settings that determine how long an old Envoy
      # process should be kept alive after an occasional reload.
      drainDuration: 45s
      parentShutdownDuration: 1m0s
      #
      # Port where Envoy listens (on local host) for admin commands
      # You can exec into the istio-proxy container in a pod and
      # curl the admin port (curl http://localhost:15000/) to obtain
      # diagnostic information from Envoy. See
      # https://lyft.github.io/envoy/docs/operations/admin.html
      # for more details
      proxyAdminPort: 15000
      #
      # Set concurrency to a specific number to control the number of Proxy worker threads.
      # If set to 0 (default), then start worker thread for each CPU thread/core.
      concurrency: {{ .Values.global.proxy.concurrency }}
      #
      {{- if eq .Values.global.proxy.tracer "lightstep" }}
      tracing:
        lightstep:
          # Address of the LightStep Satellite pool
          address: {{ .Values.global.tracer.lightstep.address }}
          # Access Token used to communicate with the Satellite pool
          accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
          # Whether communication with the Satellite pool should be secure
          secure: {{ .Values.global.tracer.lightstep.secure }}
          # Path to the file containing the cacert to use when verifying TLS
          cacertPath: {{ .Values.global.tracer.lightstep.cacertPath }}
      {{- else if eq .Values.global.proxy.tracer "zipkin" }}
      tracing:
        zipkin:
          # Address of the Zipkin collector
        {{- if .Values.global.tracer.zipkin.address }}
          address: {{ .Values.global.tracer.zipkin.address }}
        {{- else }}
          address: zipkin.{{ .Values.global.telemetryNamespace }}:9411
        {{- end }}
      {{- else if eq .Values.global.proxy.tracer "datadog" }}
      tracing:
        datadog:
          # Address of the DataDog Agent
          address: {{ .Values.global.tracer.datadog.address }}
      {{- else if eq .Values.global.proxy.tracer "stackdriver" }}
      tracing:
        stackdriver:
          # enables trace output to stdout.
          debug: {{ $.Values.global.tracer.stackdriver.debug }}
        {{- if $.Values.global.tracer.stackdriver.maxNumberOfAttributes }}
          # The global default max number of attributes per span.
          maxNumberOfAttributes: {{ $.Values.global.tracer.stackdriver.maxNumberOfAttributes }}
        {{- end }}
        {{- if $.Values.global.tracer.stackdriver.maxNumberOfAnnotations }}
          # The global default max number of annotation events per span.
          maxNumberOfAnnotations: {{ $.Values.global.tracer.stackdriver.maxNumberOfAnnotations }}
        {{- end }}
        {{- if $.Values.global.tracer.stackdriver.maxNumberOfMessageEvents }}
          # The global default max number of message events per span.
          maxNumberOfMessageEvents: {{ $.Values.global.tracer.stackdriver.maxNumberOfMessageEvents }}
        {{- end }}
      {{- end }}

    {{- $defPilotHostname := printf "istio-pilot%s.%s" .Values.version .Values.global.configNamespace }}
    {{- $pilotAddress := .Values.global.remotePilotAddress | default $defPilotHostname }}

    {{- if .Values.global.controlPlaneSecurityEnabled }}
      #
      # Mutual TLS authentication between sidecars and istio control plane.
      controlPlaneAuthPolicy: MUTUAL_TLS
      #
      # Address where istio Pilot service is running
      {{- if .Values.global.remotePilotAddress }}
      discoveryAddress: {{ $defPilotHostname }}:15011
      {{- else }}
      discoveryAddress: {{ $pilotAddress }}:15011
      {{- end }}
    {{- else }}
      #
      # Mutual TLS authentication between sidecars and istio control plane.
      controlPlaneAuthPolicy: NONE
      #
      # Address where istio Pilot service is running
      {{- if .Values.global.remotePilotAddress }}
      discoveryAddress: {{ $defPilotHostname }}:15010
      {{- else }}
      discoveryAddress: {{ $pilotAddress }}:15010
      {{- end }}
    {{- end }}
---
`)

func chartsIstioControlIstioAutoinjectTemplatesConfigmapYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioAutoinjectTemplatesConfigmapYaml, nil
}

func chartsIstioControlIstioAutoinjectTemplatesConfigmapYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioAutoinjectTemplatesConfigmapYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-autoinject/templates/configmap.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioAutoinjectTemplatesDeploymentYaml = []byte(`apiVersion: apps/v1
kind: Deployment
metadata:
  name: istio-sidecar-injector
  namespace: {{ .Release.Namespace }}
  labels:
    app: sidecarInjectorWebhook
    release: {{ .Release.Name }}
    istio: sidecar-injector
spec:
{{- if .Values.sidecarInjectorWebhook.replicaCount }}
  replicas: {{ .Values.sidecarInjectorWebhook.replicaCount }}
{{- end }}
  selector:
    matchLabels:
      istio: sidecar-injector
  strategy:
    rollingUpdate:
      maxSurge: {{ .Values.sidecarInjectorWebhook.rollingMaxSurge }}
      maxUnavailable: {{ .Values.sidecarInjectorWebhook.rollingMaxUnavailable }}
  template:
    metadata:
      labels:
        app: sidecarInjectorWebhook
        istio: sidecar-injector
{{- if eq .Release.Namespace "istio-system"}}
        heritage: Tiller
        release: istio
        chart: sidecarInjectorWebhook
{{- end }}
      annotations:
        sidecar.istio.io/inject: "false"
        {{- if .Values.sidecarInjectorWebhook.podAnnotations }}
{{ toYaml .Values.sidecarInjectorWebhook.podAnnotations | indent 8 }}
        {{- end }}
    spec:
      serviceAccountName: istio-sidecar-injector-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      containers:
        - name: sidecar-injector-webhook
{{- if contains "/" .Values.sidecarInjectorWebhook.image }}
          image: "{{ .Values.sidecarInjectorWebhook.image }}"
{{- else }}
          image: "{{ .Values.sidecarInjectorWebhook.hub | default .Values.global.hub }}/{{ .Values.sidecarInjectorWebhook.image | default "sidecar_injector" }}:{{ .Values.sidecarInjectorWebhook.tag | default .Values.global.tag }}"
{{- end }}
          imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
          args:
            - --caCertFile=/etc/istio/certs/root-cert.pem
            - --tlsCertFile=/etc/istio/certs/cert-chain.pem
            - --tlsKeyFile=/etc/istio/certs/key.pem
            - --injectConfig=/etc/istio/inject/config
            - --meshConfig=/etc/istio/config/mesh
            - --port=9443
            - --healthCheckInterval=2s
            - --healthCheckFile=/tmp/health
{{- if or .Values.global.operatorManageWebhooks .Values.global.istiod.enabled}}
            - --reconcileWebhookConfig=false
{{- else }}
            - --reconcileWebhookConfig=true
{{- end }}
                  {{- if eq .Release.Namespace "istio-system"}}
            - --webhookConfigName=istio-sidecar-injector
                  {{ else }}
            - --webhookConfigName=istio-sidecar-injector-{{ .Release.Namespace }}
                  {{- end }}
            - --log_output_level=debug
          {{- if .Values.global.logAsJson }}
            - --log_as_json
          {{- end }}
          securityContext:
            runAsUser: 1337
            runAsGroup: 1337
            runAsNonRoot: true
          volumeMounts:
          - name: config-volume
            mountPath: /etc/istio/config
            readOnly: true
          - name: certs
            mountPath: /etc/istio/certs
            readOnly: true
          - name: inject-config
            mountPath: /etc/istio/inject
            readOnly: true
          livenessProbe:
            exec:
              command:
                - /usr/local/bin/sidecar-injector
                - probe
                - --probe-path=/tmp/health
                - --interval=4s
            initialDelaySeconds: 4
            periodSeconds: 4
          readinessProbe:
            exec:
              command:
                - /usr/local/bin/sidecar-injector
                - probe
                - --probe-path=/tmp/health
                - --interval=4s
            initialDelaySeconds: 4
            periodSeconds: 4
          resources:
{{- if .Values.sidecarInjectorWebhook.resources }}
{{ toYaml .Values.sidecarInjectorWebhook.resources | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 12 }}
{{- end }}
      securityContext:
        fsGroup: 1337
      volumes:
      - name: config-volume
        configMap:
          name: injector-mesh
      - name: certs
        secret:
{{- if .Values.sidecarInjectorWebhook.selfSigned }}
          secretName: istio-sidecar-injector-self-signed
{{- else if .Values.global.certificates }}
          secretName: dns.istio-sidecar-injector-service-account
{{- else }}
          secretName: istio.istio-sidecar-injector-service-account
{{- end }}
      - name: inject-config
        configMap:
          name: istio-sidecar-injector
          items:
          - key: config
            path: config
          - key: values
            path: values
      affinity:
      {{- include "nodeaffinity" . | indent 6 }}
      {{- include "podAntiAffinity" . | indent 6 }}
{{- if .Values.sidecarInjectorWebhook.tolerations }}
      tolerations:
{{ toYaml .Values.sidecarInjectorWebhook.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}
`)

func chartsIstioControlIstioAutoinjectTemplatesDeploymentYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioAutoinjectTemplatesDeploymentYaml, nil
}

func chartsIstioControlIstioAutoinjectTemplatesDeploymentYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioAutoinjectTemplatesDeploymentYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-autoinject/templates/deployment.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioAutoinjectTemplatesMutatingwebhookYaml = []byte(`{{- $ca := genCA "istio-sidecar-injector-ca-{{ .Release.Namespace }}" 3650 }}
{{- if and (not .Values.global.operatorManageWebhooks) (not .Values.global.istiod.enabled) }}
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
        {{- if eq .Release.Namespace "istio-system"}}
  name: istio-sidecar-injector
        {{ else }}
  name: istio-sidecar-injector-{{ .Release.Namespace }}
        {{- end }}
  labels:
    app: sidecar-injector
    release: {{ .Release.Name }}
webhooks:
  - name: sidecar-injector.istio.io
    clientConfig:
      service:
        name: istio-sidecar-injector
        namespace: {{ .Release.Namespace }}
        path: "/inject"
{{- if .Values.sidecarInjectorWebhook.selfSigned }}
      caBundle: {{ $ca.Cert | b64enc }}
{{- else }}
      caBundle: ""
{{- end }}
    rules:
      - operations: [ "CREATE" ]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods"]
    failurePolicy: Fail
    namespaceSelector:
{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
      matchExpressions:
      - key: name
        operator: NotIn
        values:
        - {{ .Release.Namespace }}
      - key: istio-injection
        operator: NotIn
        values:
        - disabled
      - key: istio-env
        operator: DoesNotExist
{{- else if eq .Values.sidecarInjectorWebhook.injectLabel "istio-injection" }}
      matchLabels:
        istio-injection: enabled
{{- else }}
      matchLabels:
        istio-env: {{ .Release.Namespace }}
{{- end }}
{{- if .Values.sidecarInjectorWebhook.objectSelector.enabled }}
    objectSelector:
{{- if .Values.sidecarInjectorWebhook.objectSelector.autoInject }}
      matchExpressions:
      - key: "sidecar.istio.io/inject"
        operator: NotIn
        values:
        - "false"
{{- else }}
      matchLabels:
        "sidecar.istio.io/inject": "true"
{{- end }}
{{- end }}
{{- end }}
---
{{- if .Values.sidecarInjectorWebhook.selfSigned }}
  {{- $cn := "istio-sidecar-injector" }}
  {{- $altName1 := printf "%s.%s" $cn .Release.Namespace }}
  {{- $altName2 := printf "%s.%s.svc" $cn .Release.Namespace }}
  {{- $altNames := (list $altName1 $altName2) }}
  {{- $cert := genSignedCert $cn nil $altNames 3650 $ca }}
apiVersion: v1
kind: Secret
metadata:
  name: istio-sidecar-injector-self-signed
  namespace: {{ .Release.Namespace }}
  labels:
    app: sidecar-injector
    release: {{ .Release.Name }}
type: Opaque
data:
  root-cert.pem: {{ $ca.Cert | b64enc }}
  cert-chain.pem: {{ $cert.Cert | b64enc }}
  key.pem: {{ $cert.Key | b64enc }}
{{- end }}
`)

func chartsIstioControlIstioAutoinjectTemplatesMutatingwebhookYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioAutoinjectTemplatesMutatingwebhookYaml, nil
}

func chartsIstioControlIstioAutoinjectTemplatesMutatingwebhookYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioAutoinjectTemplatesMutatingwebhookYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-autoinject/templates/mutatingwebhook.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioAutoinjectTemplatesPoddisruptionbudgetYaml = []byte(`{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: istio-sidecar-injector
  namespace: {{ .Release.Namespace }}
  labels:
    app: sidecar-injector
    release: {{ .Release.Name }}
    istio: sidecar-injector
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app: sidecar-injector
      release: {{ .Release.Name }}
      istio: sidecar-injector
{{- end }}
`)

func chartsIstioControlIstioAutoinjectTemplatesPoddisruptionbudgetYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioAutoinjectTemplatesPoddisruptionbudgetYaml, nil
}

func chartsIstioControlIstioAutoinjectTemplatesPoddisruptionbudgetYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioAutoinjectTemplatesPoddisruptionbudgetYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-autoinject/templates/poddisruptionbudget.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioAutoinjectTemplatesServiceYaml = []byte(`apiVersion: v1
kind: Service
metadata:
  name: istio-sidecar-injector
  namespace: {{ .Release.Namespace }}
  labels:
    app: sidecarInjectorWebhook
    release: {{ .Release.Name }}
    istio: sidecar-injector
spec:
  ports:
  - port: 443
    targetPort: 9443
  selector:
    istio: sidecar-injector
`)

func chartsIstioControlIstioAutoinjectTemplatesServiceYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioAutoinjectTemplatesServiceYaml, nil
}

func chartsIstioControlIstioAutoinjectTemplatesServiceYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioAutoinjectTemplatesServiceYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-autoinject/templates/service.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioAutoinjectTemplatesServiceaccountYaml = []byte(`apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end }}
metadata:
  name: istio-sidecar-injector-service-account
  namespace: {{ .Release.Namespace }}
  labels:
    app: sidecarInjectorWebhook
    release: {{ .Release.Name }}
    istio: sidecar-injector
`)

func chartsIstioControlIstioAutoinjectTemplatesServiceaccountYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioAutoinjectTemplatesServiceaccountYaml, nil
}

func chartsIstioControlIstioAutoinjectTemplatesServiceaccountYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioAutoinjectTemplatesServiceaccountYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-autoinject/templates/serviceaccount.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioAutoinjectTemplatesSidecarInjectorConfigmapYaml = []byte(`{{- if not .Values.global.omitSidecarInjectorConfigMap }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-sidecar-injector
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
    app: sidecar-injector
    istio: sidecar-injector
data:
  values: |-
    {{ .Values | toJson }}

  config: |-
    policy: {{ .Values.global.proxy.autoInject }}
    alwaysInjectSelector:
{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
    neverInjectSelector:
{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
{{ .Files.Get "files/injection-template.yaml" | trim | indent 4 }}
    injectedAnnotations:
    {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
      "{{ $key }}": "{{ $val }}"
    {{- end }}

{{- end }}
`)

func chartsIstioControlIstioAutoinjectTemplatesSidecarInjectorConfigmapYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioAutoinjectTemplatesSidecarInjectorConfigmapYaml, nil
}

func chartsIstioControlIstioAutoinjectTemplatesSidecarInjectorConfigmapYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioAutoinjectTemplatesSidecarInjectorConfigmapYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-autoinject/templates/sidecar-injector-configmap.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioAutoinjectValuesYaml = []byte(`sidecarInjectorWebhook:
  # sidecar-injector webhook configuration.
  # If down, new pods will fail to start or restart for a short time, but they will
  # retry.
  replicaCount: 1
  rollingMaxSurge: 100%
  rollingMaxUnavailable: 25%

  hub: ""
  tag: ""
  image: sidecar_injector

  # This enables injection of sidecar in all namespaces,
  # with the exception of namespaces with "istio-injection:disabled" annotation
  # Only one environment should have this enabled.
  enableNamespacesByDefault: false

  # If true, webhook or istioctl injector will rewrite PodSpec for liveness
  # health check to redirect request to sidecar. This makes liveness check work
  # even when mTLS is enabled.
  rewriteAppHTTPProbe: true

  # If true, a self-signed CA will created in order to issue a certificate that
  # will be used to authenticate the workload respondible for handling
  # the sidecar-injector webhook.
  selfSigned: false

  nodeSelector: {}
  tolerations: []
  podAnnotations: {}

  # injectedAnnotations are additional annotations that will be added to the pod spec after injection
  # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
  #
  # annotations:
  #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
  #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
  #
  # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
  # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
  # injectedAnnotations:
  #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
  #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
  injectedAnnotations: {}
  lifecycle: {}

  # If set, will use the value as injection label. The value must match the 'release' label of the injector,
  # except when 1.2 istio-injection label is used, which must be set to "enabled".
  injectLabel: istio-injection

  # Specify the pod anti-affinity that allows you to constrain which nodes
  # your pod is eligible to be scheduled based on labels on pods that are
  # already running on the node rather than based on labels on nodes.
  # There are currently two types of anti-affinity:
  #    "requiredDuringSchedulingIgnoredDuringExecution"
  #    "preferredDuringSchedulingIgnoredDuringExecution"
  # which denote "hard" vs. "soft" requirements, you can define your values
  # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
  # correspondingly.
  # For example:
  # podAntiAffinityLabelSelector:
  # - key: security
  #   operator: In
  #   values: S1,S2
  #   topologyKey: "kubernetes.io/hostname"
  # This pod anti-affinity rule says that the pod requires not to be scheduled
  # onto a node if that node is already running a pod with label having key
  # "security" and value "S1".
  podAntiAffinityLabelSelector: []
  podAntiAffinityTermLabelSelector: []

  # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
  # always skip the injection on pods that match that label selector, regardless of the global policy.
  # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
  neverInjectSelector: []
  alwaysInjectSelector: []

  resources: {}

  # Enable objectSelector to filter out pods with no need for sidecar before calling istio-sidecar-injector.
  # It is disabled by default since this function will only work after k8s v1.15.
  objectSelector:
    enabled: false
    autoInject: true

# If set, no iptable init will be added. It assumes CNI is installed.
# TODO: rename to 'enableIptables' or add 'interceptionMode: CNI'
istio_cni:
  enabled: false
`)

func chartsIstioControlIstioAutoinjectValuesYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioAutoinjectValuesYaml, nil
}

func chartsIstioControlIstioAutoinjectValuesYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioAutoinjectValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-autoinject/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioConfigChartYaml = []byte(`apiVersion: v1
name: istio-config
version: 1.1.0
appVersion: 1.1.0
tillerVersion: ">=2.7.2"
description: Helm chart for galley deployment
keywords:
  - istio
  - galley
sources:
  - http://github.com/istio/istio
engine: gotpl
icon: https://istio.io/favicons/android-192x192.png
`)

func chartsIstioControlIstioConfigChartYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioConfigChartYaml, nil
}

func chartsIstioControlIstioConfigChartYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioConfigChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-config/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioConfigOwners = []byte(`approvers:
  - cmluciano
  - geeknoid
  - ozevren
  - ayj
`)

func chartsIstioControlIstioConfigOwnersBytes() ([]byte, error) {
	return _chartsIstioControlIstioConfigOwners, nil
}

func chartsIstioControlIstioConfigOwners() (*asset, error) {
	bytes, err := chartsIstioControlIstioConfigOwnersBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-config/OWNERS", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioConfigReadmeMd = []byte(`# Istio Config

This component handles the configuration, exposing an MCP server.

The default implementation is Galley, using the K8S apiserver for storage - other MCP providers may be configured.

It is recommended to run only one production config server - it registers a validation webhook which will apply
to all Istio configs. It is possible to run a second staging/canary config server in a different namespace.

## Installation

Galley relies on DNS certificates. Before installing it in a custom namespace you should update Citadel or
create a custom certificate.

## Validation

A cluster should have a single galley with validation enabled - usually the prod environment.
It is possible to enable validation on other environments as well - but each Galley will do its own
validation, and a staging version may impact production validation.

`+"`"+``+"`"+``+"`"+`yamml
security:
    ...
    dnsCerts:
        ...
        istio-galley-service-account.MY_NAMESPACE: istio-galley.MY_NAMESPACE.svc
`+"`"+``+"`"+``+"`"+`
`)

func chartsIstioControlIstioConfigReadmeMdBytes() ([]byte, error) {
	return _chartsIstioControlIstioConfigReadmeMd, nil
}

func chartsIstioControlIstioConfigReadmeMd() (*asset, error) {
	bytes, err := chartsIstioControlIstioConfigReadmeMdBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-config/README.md", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioConfigTemplates_affinityTpl = []byte(`{{/* affinity - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ */}}

{{- define "nodeaffinity" }}
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityRequiredDuringScheduling" . }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityPreferredDuringScheduling" . }}
{{- end }}

{{- define "nodeAffinityRequiredDuringScheduling" }}
      nodeSelectorTerms:
      - matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
        {{- range $key, $val := .Values.global.arch }}
          {{- if gt ($val | int) 0 }}
          - {{ $key | quote }}
          {{- end }}
        {{- end }}
        {{- $nodeSelector := default .Values.global.defaultNodeSelector .Values.galley.nodeSelector -}}
        {{- range $key, $val := $nodeSelector }}
        - key: {{ $key }}
          operator: In
          values:
          - {{ $val | quote }}
        {{- end }}
{{- end }}

{{- define "nodeAffinityPreferredDuringScheduling" }}
  {{- range $key, $val := .Values.global.arch }}
    {{- if gt ($val | int) 0 }}
    - weight: {{ $val | int }}
      preference:
        matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
          - {{ $key | quote }}
    {{- end }}
  {{- end }}
{{- end }}

{{- define "podAntiAffinity" }}
{{- if or .Values.galley.podAntiAffinityLabelSelector .Values.galley.podAntiAffinityTermLabelSelector}}
  podAntiAffinity:
    {{- if .Values.galley.podAntiAffinityLabelSelector }}
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityRequiredDuringScheduling" . }}
    {{- end }}
    {{- if .Values.galley.podAntiAffinityTermLabelSelector }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityPreferredDuringScheduling" . }}
    {{- end }}
{{- end }}
{{- end }}

{{- define "podAntiAffinityRequiredDuringScheduling" }}
    {{- range $index, $item := .Values.galley.podAntiAffinityLabelSelector }}
    - labelSelector:
        matchExpressions:
        - key: {{ $item.key }}
          operator: {{ $item.operator }}
          {{- if $item.values }}
          values:
          {{- $vals := split "," $item.values }}
          {{- range $i, $v := $vals }}
          - {{ $v | quote }}
          {{- end }}
          {{- end }}
      topologyKey: {{ $item.topologyKey }}
    {{- end }}
{{- end }}

{{- define "podAntiAffinityPreferredDuringScheduling" }}
    {{- range $index, $item := .Values.galley.podAntiAffinityTermLabelSelector }}
    - podAffinityTerm:
        labelSelector:
          matchExpressions:
          - key: {{ $item.key }}
            operator: {{ $item.operator }}
            {{- if $item.values }}
            values:
            {{- $vals := split "," $item.values }}
            {{- range $i, $v := $vals }}
            - {{ $v | quote }}
            {{- end }}
            {{- end }}
        topologyKey: {{ $item.topologyKey }}
      weight: 100
    {{- end }}
{{- end }}
`)

func chartsIstioControlIstioConfigTemplates_affinityTplBytes() ([]byte, error) {
	return _chartsIstioControlIstioConfigTemplates_affinityTpl, nil
}

func chartsIstioControlIstioConfigTemplates_affinityTpl() (*asset, error) {
	bytes, err := chartsIstioControlIstioConfigTemplates_affinityTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-config/templates/_affinity.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioConfigTemplates_helpersTpl = []byte(`{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "pilot.name" -}}
{{- default .Chart.Name .Values.galley.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "pilot.fullname" -}}
{{- if .Values.galley.fullnameOverride -}}
{{- .Values.galley.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.galley.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "pilot.chart" -}}
{{- .Chart.Name | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{- define "istio.configmap.checksum" -}}
{{- print $.Template.BasePath "/configmap.yaml" | sha256sum -}}
{{- end -}}
`)

func chartsIstioControlIstioConfigTemplates_helpersTplBytes() ([]byte, error) {
	return _chartsIstioControlIstioConfigTemplates_helpersTpl, nil
}

func chartsIstioControlIstioConfigTemplates_helpersTpl() (*asset, error) {
	bytes, err := chartsIstioControlIstioConfigTemplates_helpersTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-config/templates/_helpers.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioConfigTemplatesClusterroleYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-galley-{{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
rules:
  # For reading Istio resources
  - apiGroups: [
    "authentication.istio.io",
    "config.istio.io",
    "networking.istio.io",
    "rbac.istio.io",
    "security.istio.io"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]
    # For updating Istio resource statuses
  - apiGroups: [
    "authentication.istio.io",
    "config.istio.io",
    "networking.istio.io",
    "rbac.istio.io",
    "security.istio.io"]
    resources: ["*/status"]
    verbs: ["update"]
    # Remove galley's permissions to reconcile the validation config when istiod is present.
{{- if not (or .Values.global.operatorManageWebhooks .Values.global.istiod.enabled) }}
  - apiGroups: ["admissionregistration.k8s.io"]
    resources: ["validatingwebhookconfigurations"]
    verbs: ["*"]
  # permissions to verify the webhook is ready and rejecting
  # invalid config. We use --server-dry-run so no config is persisted.
  - apiGroups: ["networking.istio.io"]
    verbs: ["create"]
    resources: ["gateways"]
{{- end }}
  - apiGroups: ["extensions","apps"]
    resources: ["deployments"]
    resourceNames: ["istio-galley"]
    verbs: ["get"]
  - apiGroups: [""]
    resources: ["pods", "nodes", "services", "endpoints", "namespaces"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources: ["deployments/finalizers"]
    resourceNames: ["istio-galley"]
    verbs: ["update"]
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["clusterroles"]
    verbs: ["get", "list", "watch"]
---
`)

func chartsIstioControlIstioConfigTemplatesClusterroleYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioConfigTemplatesClusterroleYaml, nil
}

func chartsIstioControlIstioConfigTemplatesClusterroleYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioConfigTemplatesClusterroleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-config/templates/clusterrole.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioConfigTemplatesClusterrolebindingYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-galley-admin-role-binding-{{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istio-galley-{{ .Release.Namespace }}
subjects:
  - kind: ServiceAccount
    name: istio-galley-service-account
    namespace: {{ .Release.Namespace }}
---
`)

func chartsIstioControlIstioConfigTemplatesClusterrolebindingYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioConfigTemplatesClusterrolebindingYaml, nil
}

func chartsIstioControlIstioConfigTemplatesClusterrolebindingYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioConfigTemplatesClusterrolebindingYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-config/templates/clusterrolebinding.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioConfigTemplatesConfigmapEnvoyYaml = []byte(`{{- if .Values.global.controlPlaneSecurityEnabled }}
apiVersion: v1
kind: ConfigMap
metadata:
  namespace: {{ .Release.Namespace }}
  name: galley-envoy-config
  labels:
    app: galley
    istio: galley
    release: {{ .Release.Name }}
data:
  envoy.yaml.tmpl: |-
    admin:
      access_log_path: /dev/null
      address:
        socket_address:
          address: 127.0.0.1
          port_value: 15000

    static_resources:

      clusters:
      - name: in.9901
        http2_protocol_options: {}
        connect_timeout: 1.000s

        hosts:
        - socket_address:
            address: 127.0.0.1
            port_value: 9901

        circuit_breakers:
          thresholds:
          - max_connections: 100000
            max_pending_requests: 100000
            max_requests: 100000
            max_retries: 3

      listeners:
      - name: "15019"
        address:
          socket_address:
            address: 0.0.0.0
            port_value: 15019
        filter_chains:
        - filters:
          - name: envoy.http_connection_manager
            config:
              codec_type: HTTP2
              stat_prefix: "15010"
              stream_idle_timeout: 0s
              http2_protocol_options:
                max_concurrent_streams: 1073741824

              access_log:
              - name: envoy.file_access_log
                config:
                  path: /dev/stdout

              http_filters:
              - name: envoy.router

              route_config:
                name: "15019"

                virtual_hosts:
                - name: istio-galley

                  domains:
                  - '*'

                  routes:
                  - match:
                      prefix: /
                    route:
                      cluster: in.9901
                      timeout: 0.000s
          tls_context:
            common_tls_context:
              alpn_protocols:
              - h2
              tls_certificates:
              - certificate_chain:
                  filename: /etc/certs/cert-chain.pem
                private_key:
                  filename: /etc/certs/key.pem
              validation_context:
                trusted_ca:
                  filename: /etc/certs/root-cert.pem
            require_client_certificate: true
{{- end }}
---
`)

func chartsIstioControlIstioConfigTemplatesConfigmapEnvoyYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioConfigTemplatesConfigmapEnvoyYaml, nil
}

func chartsIstioControlIstioConfigTemplatesConfigmapEnvoyYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioConfigTemplatesConfigmapEnvoyYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-config/templates/configmap-envoy.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioConfigTemplatesConfigmapMeshYaml = []byte(`apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-mesh-galley
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
data:
  mesh: |-
{{ toYaml .Values.galley.mesh | indent 4 }}
---
`)

func chartsIstioControlIstioConfigTemplatesConfigmapMeshYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioConfigTemplatesConfigmapMeshYaml, nil
}

func chartsIstioControlIstioConfigTemplatesConfigmapMeshYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioConfigTemplatesConfigmapMeshYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-config/templates/configmap-mesh.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioConfigTemplatesConfigmapYaml = []byte(`apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-galley-configuration
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
data:
{{- if .Values.global.configValidation }}
  validatingwebhookconfiguration.yaml: |-
    {{- include "validatingwebhookconfiguration.yaml.tpl" . | indent 4}}
{{- end}}
---
`)

func chartsIstioControlIstioConfigTemplatesConfigmapYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioConfigTemplatesConfigmapYaml, nil
}

func chartsIstioControlIstioConfigTemplatesConfigmapYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioConfigTemplatesConfigmapYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-config/templates/configmap.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioConfigTemplatesDeploymentYaml = []byte(`apiVersion: apps/v1
kind: Deployment
metadata:
  name: istio-galley
  namespace: {{ .Release.Namespace }}
  labels:
    app: galley
    istio: galley
    release: {{ .Release.Name }}
spec:
  replicas: {{ .Values.galley.replicaCount }}
  selector:
    matchLabels:
      istio: galley
  strategy:
    rollingUpdate:
      maxSurge: {{ .Values.galley.rollingMaxSurge }}
      maxUnavailable: {{ .Values.galley.rollingMaxUnavailable }}
  template:
    metadata:
      labels:
        app: galley
        istio: galley
{{- if eq .Release.Namespace "istio-system"}}
        heritage: Tiller
        release: istio
        chart: galley
{{- end }}
      annotations:
        sidecar.istio.io/inject: "false"
        {{- if .Values.galley.podAnnotations }}
{{ toYaml .Values.galley.podAnnotations | indent 8 }}
        {{- end }}
    spec:
      serviceAccountName: istio-galley-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      containers:
        - name: galley
{{- if contains "/" .Values.galley.image }}
          image: "{{ .Values.galley.image }}"
{{- else }}
          image: "{{ .Values.galley.hub | default .Values.global.hub }}/{{ .Values.galley.image | default "galley" }}:{{ .Values.galley.tag | default .Values.global.tag }}"
{{- end }}
          imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
          ports:
          - containerPort: 9443
          - containerPort: 15014
          - containerPort: 15019
          - containerPort: 9901
          command:
          - /usr/local/bin/galley
          - server
          - --meshConfigFile=/etc/mesh-config/mesh
          - --livenessProbeInterval=1s
          - --livenessProbePath=/tmp/healthliveness
          - --readinessProbePath=/tmp/healthready
          - --readinessProbeInterval=1s
          - --insecure=true
  {{- if and .Values.global.configValidation (not .Values.global.istiod.enabled) }}
          - --enable-validation=true
  {{- else }}
          - --enable-validation=false
  {{- end }}
  {{- if or .Values.global.operatorManageWebhooks .Values.global.istiod.enabled  }}
          - --enable-reconcileWebhookConfiguration=false
  {{- else }}
          - --enable-reconcileWebhookConfiguration=true
  {{- end }}
  {{- if .Values.galley.enableServiceDiscovery }}
          - --enableServiceDiscovery=true
  {{- end }}
          - --enable-server=true
  {{- if .Values.galley.enableAnalysis }}
          - --enableAnalysis=true
  {{- end }}
          - --deployment-namespace={{ .Release.Namespace }}
          - --monitoringPort=15014
          - --validation-port=9443
{{- if $.Values.global.logging.level }}
          - --log_output_level={{ $.Values.global.logging.level }}
{{- end}}
{{- if .Values.global.certificates }}
          - --validation.tls.clientCertificate=/etc/dnscerts/cert-chain.pem
          - --validation.tls.privateKey=/etc/dnscerts/key.pem
          - --validation.tls.caCertificates=/etc/dnscerts/root-cert.pem
{{- end }}
          securityContext:
            runAsUser: 1337
            runAsGroup: 1337
            runAsNonRoot: true
            capabilities:
              drop:
              - ALL
          volumeMounts:
  {{- if and .Values.global.configValidation (not .Values.global.istiod.enabled) }}
          - name: istio-certs
            mountPath: /etc/certs
            readOnly: true
  {{- end }}
  {{- if .Values.global.certificates }}
          - name: dnscerts
            mountPath: /etc/dnscerts
            readOnly: true
  {{- end }}
          - name: config
            mountPath: /etc/config
            readOnly: true
          - name: mesh-config
            mountPath: /etc/mesh-config
            readOnly: true
          livenessProbe:
            exec:
              command:
                - /usr/local/bin/galley
                - probe
                - --probe-path=/tmp/healthliveness
                - --interval=10s
            initialDelaySeconds: 5
            periodSeconds: 5
          readinessProbe:
            exec:
              command:
                - /usr/local/bin/galley
                - probe
                - --probe-path=/tmp/healthready
                - --interval=10s
            initialDelaySeconds: 5
            periodSeconds: 5
          resources:
{{- if .Values.galley.resources }}
{{ toYaml .Values.galley.resources | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 12 }}
{{- end }}

{{- if .Values.global.controlPlaneSecurityEnabled }}
        - name: istio-proxy
{{- if contains "/" .Values.global.proxy.image }}
          image: "{{ .Values.global.proxy.image }}"
{{- else }}
          image: "{{ .Values.global.hub | default "gcr.io/istio-release" }}/{{ .Values.global.proxy.image | default "proxyv2" }}:{{ .Values.global.tag | default "release-1.1-latest-daily" }}"
{{- end }}
          imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
          ports:
          - containerPort: 9902
          args:
          - proxy
          - --serviceCluster
          - istio-galley
          - --templateFile
          - /var/lib/istio/galley/envoy/envoy.yaml.tmpl
          - --controlPlaneAuthPolicy
          - MUTUAL_TLS
        {{- if .Values.global.trustDomain }}
          - --trust-domain={{ .Values.global.trustDomain }}
        {{- end }}
        {{- if .Values.global.logAsJson }}
          - --log_as_json
        {{- end }}
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: INSTANCE_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.podIP
          resources:
{{- if .Values.global.proxy.resources }}
{{ toYaml .Values.global.proxy.resources | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 12 }}
{{- end }}
          volumeMounts:
          - name: istio-certs
            mountPath: /etc/certs
            readOnly: true
          - name: envoy-config
            mountPath: /var/lib/istio/galley/envoy
{{- end }}
      securityContext:
        fsGroup: 1337
      volumes:
  {{- if or .Values.global.controlPlaneSecurityEnabled (and .Values.global.configValidation (not .Values.global.istiod.enabled)) }}
      - name: istio-certs
        secret:
          secretName: istio.istio-galley-service-account
  {{- end }}
  {{- if .Values.global.certificates }}
      - name: dnscerts
        secret:
          secretName: dns.istio-galley-service-account
  {{- end }}
  {{- if .Values.global.controlPlaneSecurityEnabled }}
      - name: envoy-config
        configMap:
          name: galley-envoy-config
  {{- end }}
      # galley expects /etc/config to exist even though it doesn't include any files.
      - name: config
        emptyDir:
          medium: Memory
      # Different config map from pilot, to allow independent config and rollout.
      # Both are derived from values.yaml.
      - name: mesh-config
        configMap:
          name: istio-mesh-galley

      affinity:
      {{- include "nodeaffinity" . | indent 6 }}
      {{- include "podAntiAffinity" . | indent 6 }}
{{- if .Values.galley.tolerations }}
      tolerations:
{{ toYaml .Values.galley.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}
---
`)

func chartsIstioControlIstioConfigTemplatesDeploymentYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioConfigTemplatesDeploymentYaml, nil
}

func chartsIstioControlIstioConfigTemplatesDeploymentYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioConfigTemplatesDeploymentYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-config/templates/deployment.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioConfigTemplatesPoddisruptionbudgetYaml = []byte(`{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: istio-galley
  namespace: {{ .Release.Namespace }}
  labels:
    app: galley
    release: {{ .Release.Name }}
    istio: galley
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app: galley
      release: {{ .Release.Name }}
      istio: galley
---

{{- end }}
`)

func chartsIstioControlIstioConfigTemplatesPoddisruptionbudgetYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioConfigTemplatesPoddisruptionbudgetYaml, nil
}

func chartsIstioControlIstioConfigTemplatesPoddisruptionbudgetYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioConfigTemplatesPoddisruptionbudgetYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-config/templates/poddisruptionbudget.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioConfigTemplatesServiceYaml = []byte(`apiVersion: v1
kind: Service
metadata:
  name: istio-galley
  namespace: {{ .Release.Namespace }}
  labels:
    app: galley
    istio: galley
    release: {{ .Release.Name }}
spec:
  ports:
  - port: 443
    name: https-validation
    targetPort: 9443
  - port: 15014
    name: http-monitoring
  - port: 9901
    name: grpc-mcp
  - port: 15019
    name: grpc-tls-mcp
  selector:
    istio: galley
---
`)

func chartsIstioControlIstioConfigTemplatesServiceYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioConfigTemplatesServiceYaml, nil
}

func chartsIstioControlIstioConfigTemplatesServiceYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioConfigTemplatesServiceYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-config/templates/service.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioConfigTemplatesServiceaccountYaml = []byte(`apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end }}
metadata:
  name: istio-galley-service-account
  namespace: {{ .Release.Namespace }}
  labels:
    app: galley
    release: {{ .Release.Name }}
---
`)

func chartsIstioControlIstioConfigTemplatesServiceaccountYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioConfigTemplatesServiceaccountYaml, nil
}

func chartsIstioControlIstioConfigTemplatesServiceaccountYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioConfigTemplatesServiceaccountYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-config/templates/serviceaccount.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioConfigTemplatesValidatingwebhookconfigurationYaml = []byte(`{{/*
This version of the validatingwebhookconfiguration is applied directly by
istio/operator. Galley only patches the caBundle and failurePolicy.
*/}}
{{- if .Values.global.istiod.enabled }}
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: istio-galley
  labels:
    app: galley
    release: {{ .Release.Name }}
    istio: galley
webhooks:
{{- else }}
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: istio-galley
  labels:
    app: galley
    release: {{ .Release.Name }}
    istio: galley
webhooks:
  - name: pilot.validation.istio.io
    clientConfig:
      service:
        name: istio-galley
        namespace: {{ .Release.Namespace }}
        path: "/admitpilot"
      caBundle: ""
    rules:
      - operations:
        - CREATE
        - UPDATE
        apiGroups:
        - config.istio.io
        apiVersions:
        - v1alpha2
        resources:
        - httpapispecs
        - httpapispecbindings
        - quotaspecs
        - quotaspecbindings
      - operations:
        - CREATE
        - UPDATE
        apiGroups:
        - rbac.istio.io
        - security.istio.io
        - authentication.istio.io
        - networking.istio.io
        apiVersions:
        - "*"
        resources:
        - "*"
    # Fail open until the validation webhook is ready. The webhook controller
    # will update this to `+"`"+`Fail`+"`"+` and patch in the `+"`"+`caBundle`+"`"+` when the webhook
    # endpoint is ready.
    failurePolicy: Ignore
    sideEffects: None
  - name: mixer.validation.istio.io
    clientConfig:
      service:
        name: istio-galley
        namespace: {{ .Release.Namespace }}
        path: "/admitmixer"
      caBundle: ""
    rules:
      - operations:
        - CREATE
        - UPDATE
        apiGroups:
        - config.istio.io
        apiVersions:
        - v1alpha2
        resources:
        - rules
        - attributemanifests
        - adapters
        - handlers
        - instances
        - templates
    # Fail open until the validation webhook is ready. The webhook controller
    # will update this to `+"`"+`Fail`+"`"+` and patch in the `+"`"+`caBundle`+"`"+` when the webhook
    # endpoint is ready.
    failurePolicy: Ignore
    sideEffects: None
{{- end }}
---
`)

func chartsIstioControlIstioConfigTemplatesValidatingwebhookconfigurationYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioConfigTemplatesValidatingwebhookconfigurationYaml, nil
}

func chartsIstioControlIstioConfigTemplatesValidatingwebhookconfigurationYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioConfigTemplatesValidatingwebhookconfigurationYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-config/templates/validatingwebhookconfiguration.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioConfigTemplatesValidatingwebhookconfigurationYamlTpl = []byte(`{{/*
This version of the validatingwebhookconfiguration is applied indirectly
by galley. This exists to support a smoother upgrade path from istio
Rversions < 1.4
*/}}
{{ define "validatingwebhookconfiguration.yaml.tpl" }}
{{- if .Values.global.istiod.enabled }}
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: istio-galley
  labels:
    app: galley
    release: {{ .Release.Name }}
    istio: galley
webhooks:
{{- else }}
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: istio-galley
  labels:
    app: galley
    release: {{ .Release.Name }}
    istio: galley
webhooks:
  - name: pilot.validation.istio.io
    clientConfig:
      service:
        name: istio-galley
        namespace: {{ .Release.Namespace }}
        path: "/admitpilot"
      caBundle: ""
    rules:
      - operations:
        - CREATE
        - UPDATE
        apiGroups:
        - config.istio.io
        apiVersions:
        - v1alpha2
        resources:
        - httpapispecs
        - httpapispecbindings
        - quotaspecs
        - quotaspecbindings
      - operations:
        - CREATE
        - UPDATE
        apiGroups:
        - rbac.istio.io
        - security.istio.io
        - authentication.istio.io
        - networking.istio.io
        apiVersions:
        - "*"
        resources:
        - "*"
    # Fail open until the validation webhook is ready. The webhook controller
    # will update this to `+"`"+`Fail`+"`"+` and patch in the `+"`"+`caBundle`+"`"+` when the webhook
    # endpoint is ready.
    failurePolicy: Ignore
    sideEffects: None
  - name: mixer.validation.istio.io
    clientConfig:
      service:
        name: istio-galley
        namespace: {{ .Release.Namespace }}
        path: "/admitmixer"
      caBundle: ""
    rules:
      - operations:
        - CREATE
        - UPDATE
        apiGroups:
        - config.istio.io
        apiVersions:
        - v1alpha2
        resources:
        - rules
        - attributemanifests
        - adapters
        - handlers
        - instances
        - templates
    # Fail open until the validation webhook is ready. The webhook controller
    # will update this to `+"`"+`Fail`+"`"+` and patch in the `+"`"+`caBundle`+"`"+` when the webhook
    # endpoint is ready.
    failurePolicy: Ignore
    sideEffects: None
{{- end }}
{{- end }}
---
`)

func chartsIstioControlIstioConfigTemplatesValidatingwebhookconfigurationYamlTplBytes() ([]byte, error) {
	return _chartsIstioControlIstioConfigTemplatesValidatingwebhookconfigurationYamlTpl, nil
}

func chartsIstioControlIstioConfigTemplatesValidatingwebhookconfigurationYamlTpl() (*asset, error) {
	bytes, err := chartsIstioControlIstioConfigTemplatesValidatingwebhookconfigurationYamlTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-config/templates/validatingwebhookconfiguration.yaml.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioConfigValuesYaml = []byte(`galley:
  hub: ""
  tag: ""
  image: galley
  replicaCount: 1
  rollingMaxSurge: 100%
  rollingMaxUnavailable: 25%

  enableServiceDiscovery: false

  resources:
    requests:
      cpu: 100m
    #   memory: 128Mi
    # limits:
    #   cpu: 100m
    #   memory: 128Mi

  # TODO: Galley appears to use the mesh config - need to find which fields are used and need to be configured.
  mesh: {}

  nodeSelector: {}
  tolerations: []
  podAnnotations: {}

  # Specify the pod anti-affinity that allows you to constrain which nodes
  # your pod is eligible to be scheduled based on labels on pods that are
  # already running on the node rather than based on labels on nodes.
  # There are currently two types of anti-affinity:
  #    "requiredDuringSchedulingIgnoredDuringExecution"
  #    "preferredDuringSchedulingIgnoredDuringExecution"
  # which denote "hard" vs. "soft" requirements, you can define your values
  # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
  # correspondingly.
  # For example:
  # podAntiAffinityLabelSelector:
  # - key: security
  #   operator: In
  #   values: S1,S2
  #   topologyKey: "kubernetes.io/hostname"
  # This pod anti-affinity rule says that the pod requires not to be scheduled
  # onto a node if that node is already running a pod with label having key
  # "security" and value "S1".
  podAntiAffinityLabelSelector: []
  podAntiAffinityTermLabelSelector: []

  # Enable analysis and status update in Galley
  enableAnalysis: false
`)

func chartsIstioControlIstioConfigValuesYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioConfigValuesYaml, nil
}

func chartsIstioControlIstioConfigValuesYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioConfigValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-config/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryChartYaml = []byte(`apiVersion: v1
name: istio-discovery
version: 1.1.0
appVersion: 1.1.0
tillerVersion: ">=2.7.2"
description: Helm chart for istio control plane
keywords:
  - istio
sources:
  - http://github.com/istio/istio
engine: gotpl
icon: https://istio.io/favicons/android-192x192.png
`)

func chartsIstioControlIstioDiscoveryChartYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryChartYaml, nil
}

func chartsIstioControlIstioDiscoveryChartYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryNotesTxt = []byte(`Minimal control plane for Istio. Pilot and mesh config are included.

MCP and injector should optionally be installed in the same namespace. Alternatively remote
address of an MCP server can be set.

`)

func chartsIstioControlIstioDiscoveryNotesTxtBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryNotesTxt, nil
}

func chartsIstioControlIstioDiscoveryNotesTxt() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryNotesTxtBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/NOTES.txt", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryFilesInjectionTemplateYaml = []byte(`# Configmap optimized for Istiod. Please DO NOT MERGE all changes from istio - in particular those dependent on
# Values.yaml, which should not be used by istiod.

# Istiod only uses SDS based config ( files will mapped/handled by SDS).

template: |
  rewriteAppHTTPProbe: {{ valueOrDefault .Values.sidecarInjectorWebhook.rewriteAppHTTPProbe true }}
  initContainers:
  {{ if ne (annotation .ObjectMeta `+"`"+`sidecar.istio.io/interceptionMode`+"`"+` .ProxyConfig.InterceptionMode) `+"`"+`NONE`+"`"+` }}
  {{ if .Values.istio_cni.enabled -}}
  - name: istio-validation
  {{ else -}}
  - name: istio-init
  {{ end -}}
  {{- if contains "/" .Values.global.proxy_init.image }}
    image: "{{ .Values.global.proxy_init.image }}"
  {{- else }}
    image: "{{ .Values.global.hub }}/{{ .Values.global.proxy_init.image }}:{{ .Values.global.tag }}"
  {{- end }}
    command:
    - istio-iptables
    - "-p"
    - 15001
    - "-z"
    - "15006"
    - "-u"
    - 1337
    - "-m"
    - "{{ annotation .ObjectMeta `+"`"+`sidecar.istio.io/interceptionMode`+"`"+` .ProxyConfig.InterceptionMode }}"
    - "-i"
    - "{{ annotation .ObjectMeta `+"`"+`traffic.sidecar.istio.io/includeOutboundIPRanges`+"`"+` .Values.global.proxy.includeIPRanges }}"
    - "-x"
    - "{{ annotation .ObjectMeta `+"`"+`traffic.sidecar.istio.io/excludeOutboundIPRanges`+"`"+` .Values.global.proxy.excludeIPRanges }}"
    - "-b"
    - "{{ annotation .ObjectMeta `+"`"+`traffic.sidecar.istio.io/includeInboundPorts`+"`"+` `+"`"+`*`+"`"+` }}"
    - "-d"
    - "15090,{{ excludeInboundPort (annotation .ObjectMeta `+"`"+`status.sidecar.istio.io/port`+"`"+` .Values.global.proxy.statusPort) (annotation .ObjectMeta `+"`"+`traffic.sidecar.istio.io/excludeInboundPorts`+"`"+` .Values.global.proxy.excludeInboundPorts) }}"
    {{ if or (isset .ObjectMeta.Annotations `+"`"+`traffic.sidecar.istio.io/excludeOutboundPorts`+"`"+`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
    - "-o"
    - "{{ annotation .ObjectMeta `+"`"+`traffic.sidecar.istio.io/excludeOutboundPorts`+"`"+` .Values.global.proxy.excludeOutboundPorts }}"
    {{ end -}}
    {{ if (isset .ObjectMeta.Annotations `+"`"+`traffic.sidecar.istio.io/kubevirtInterfaces`+"`"+`) -}}
    - "-k"
    - "{{ index .ObjectMeta.Annotations `+"`"+`traffic.sidecar.istio.io/kubevirtInterfaces`+"`"+` }}"
    {{ end -}}
    {{ if .Values.istio_cni.enabled -}}
    - "--run-validation"
    - "--skip-rule-apply"
    {{ end -}}
    imagePullPolicy: "{{ valueOrDefault .Values.global.imagePullPolicy `+"`"+`Always`+"`"+` }}"
  {{- if .Values.global.proxy_init.resources }}
    resources:
      {{ toYaml .Values.global.proxy_init.resources | indent 4 }}
  {{- else }}
    resources: {}
  {{- end }}
    securityContext:
      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
      privileged: {{ .Values.global.proxy.privileged }}
      capabilities:
    {{- if not .Values.istio_cni.enabled }}
        add:
        - NET_ADMIN
        - NET_RAW
    {{- end }}
        drop:
        - ALL
    {{- if not .Values.istio_cni.enabled }}
      readOnlyRootFilesystem: false
      runAsGroup: 0
      runAsNonRoot: false
      runAsUser: 0
    {{- else }}
      readOnlyRootFilesystem: true
      runAsGroup: 1337
      runAsUser: 1337
      runAsNonRoot: true
    {{- end }}
    restartPolicy: Always
  {{ end -}}
  {{- if eq .Values.global.proxy.enableCoreDump true }}
  - name: enable-core-dump
    args:
    - -c
    - sysctl -w kernel.core_pattern=/var/lib/istio/data/core.proxy && ulimit -c unlimited
    command:
      - /bin/sh
  {{- if contains "/" .Values.global.proxy_init.image }}
    image: "{{ .Values.global.proxy_init.image }}"
  {{- else }}
    image: "{{ .Values.global.hub }}/{{ .Values.global.proxy_init.image }}:{{ .Values.global.tag }}"
  {{- end }}
    imagePullPolicy: "{{ valueOrDefault .Values.global.imagePullPolicy `+"`"+`Always`+"`"+` }}"
    resources: {}
    securityContext:
      allowPrivilegeEscalation: true
      capabilities:
        add:
        - SYS_ADMIN
        drop:
        - ALL
      privileged: true
      readOnlyRootFilesystem: false
      runAsGroup: 0
      runAsNonRoot: false
      runAsUser: 0
  {{ end }}
  containers:
  - name: istio-proxy
  {{- if contains "/" (annotation .ObjectMeta `+"`"+`sidecar.istio.io/proxyImage`+"`"+` .Values.global.proxy.image) }}
    image: "{{ annotation .ObjectMeta `+"`"+`sidecar.istio.io/proxyImage`+"`"+` .Values.global.proxy.image }}"
  {{- else }}
    image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}"
  {{- end }}
    ports:
    - containerPort: 15090
      protocol: TCP
      name: http-envoy-prom
    args:
    - proxy
    - sidecar
    - --domain
    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
    - --configPath
    - "/etc/istio/proxy"
    - --binaryPath
    - "/usr/local/bin/envoy"
    - --serviceCluster
    {{ if ne "" (index .ObjectMeta.Labels "app") -}}
    - "{{ index .ObjectMeta.Labels `+"`"+`app`+"`"+` }}.$(POD_NAMESPACE)"
    {{ else -}}
    - "{{ valueOrDefault .DeploymentMeta.Name `+"`"+`istio-proxy`+"`"+` }}.{{ valueOrDefault .DeploymentMeta.Namespace `+"`"+`default`+"`"+` }}"
    {{ end -}}
    - --drainDuration
    - "{{ formatDuration .ProxyConfig.DrainDuration }}"
    - --parentShutdownDuration
    - "{{ formatDuration .ProxyConfig.ParentShutdownDuration }}"
    - --discoveryAddress
    - "{{ annotation .ObjectMeta `+"`"+`sidecar.istio.io/discoveryAddress`+"`"+` .ProxyConfig.DiscoveryAddress }}"
  {{- if eq .Values.global.proxy.tracer "lightstep" }}
    - --lightstepAddress
    - "{{ .ProxyConfig.GetTracing.GetLightstep.GetAddress }}"
    - --lightstepAccessToken
    - "{{ .ProxyConfig.GetTracing.GetLightstep.GetAccessToken }}"
    - --lightstepSecure={{ .ProxyConfig.GetTracing.GetLightstep.GetSecure }}
    - --lightstepCacertPath
    - "{{ .ProxyConfig.GetTracing.GetLightstep.GetCacertPath }}"
  {{- else if eq .Values.global.proxy.tracer "zipkin" }}
    - --zipkinAddress
    - "{{ .ProxyConfig.GetTracing.GetZipkin.GetAddress }}"
  {{- else if eq .Values.global.proxy.tracer "datadog" }}
    - --datadogAgentAddress
    - "{{ .ProxyConfig.GetTracing.GetDatadog.GetAddress }}"
  {{- end }}
    - --proxyLogLevel={{ annotation .ObjectMeta `+"`"+`sidecar.istio.io/logLevel`+"`"+` .Values.global.proxy.logLevel}}
    - --proxyComponentLogLevel={{ annotation .ObjectMeta `+"`"+`sidecar.istio.io/componentLogLevel`+"`"+` .Values.global.proxy.componentLogLevel}}
    - --connectTimeout
    - "{{ formatDuration .ProxyConfig.ConnectTimeout }}"
  {{- if .Values.global.proxy.envoyStatsd.enabled }}
    - --statsdUdpAddress
    - "{{ .ProxyConfig.StatsdUdpAddress }}"
  {{- end }}
  {{- if .Values.global.proxy.envoyMetricsService.enabled }}
    - --envoyMetricsService
    - '{{ protoToJSON .ProxyConfig.EnvoyMetricsService }}'
  {{- end }}
  {{- if .Values.global.proxy.envoyAccessLogService.enabled }}
    - --envoyAccessLogService
    - '{{ protoToJSON .ProxyConfig.EnvoyAccessLogService }}'
  {{- end }}
    - --proxyAdminPort
    - "{{ .ProxyConfig.ProxyAdminPort }}"
    {{ if gt .ProxyConfig.Concurrency 0 -}}
    - --concurrency
    - "{{ .ProxyConfig.Concurrency }}"
    {{ end -}}
    {{- if .Values.global.istiod.enabled }}
    - --controlPlaneAuthPolicy
    - NONE
    {{- else if .Values.global.controlPlaneSecurityEnabled }}
    - --controlPlaneAuthPolicy
    - MUTUAL_TLS
    {{- else }}
    - --controlPlaneAuthPolicy
    - NONE
    {{- end }}
    - --dnsRefreshRate
    - {{ valueOrDefault .Values.global.proxy.dnsRefreshRate "300s" }}
  {{- if (ne (annotation .ObjectMeta "status.sidecar.istio.io/port" .Values.global.proxy.statusPort) "0") }}
    - --statusPort
    - "{{ annotation .ObjectMeta `+"`"+`status.sidecar.istio.io/port`+"`"+` .Values.global.proxy.statusPort }}"
  {{- end }}
  {{- if .Values.global.sts.servicePort }}
    - --stsPort={{ .Values.global.sts.servicePort }}
  {{- end }}
  {{- if .Values.global.trustDomain }}
    - --trust-domain={{ .Values.global.trustDomain }}
  {{- end }}
  {{- if .Values.global.logAsJson }}
    - --log_as_json
  {{- end }}
    - --controlPlaneBootstrap=false
  {{- if .Values.global.proxy.lifecycle }}
    lifecycle:
      {{ toYaml .Values.global.proxy.lifecycle | indent 4 }}
    {{- end }}
    env:
    - name: JWT_POLICY
      value: {{ .Values.global.jwtPolicy }}
    - name: PILOT_CERT_PROVIDER
      value: {{ .Values.global.pilotCertProvider }}
    # Temp, pending PR to make it default or based on the istiodAddr env
    - name: CA_ADDR
    {{- if .Values.global.caAddress }}
      value: {{ .Values.global.caAddress }}
    {{- else if .Values.global.configNamespace }}
      value: istio-pilot.{{ .Values.global.configNamespace }}.svc:15012
    {{- else }}
      value: istio-pilot.istio-system.svc:15012
    {{- end }}
    - name: POD_NAME
      valueFrom:
        fieldRef:
          fieldPath: metadata.name
    - name: POD_NAMESPACE
      valueFrom:
        fieldRef:
          fieldPath: metadata.namespace
    - name: INSTANCE_IP
      valueFrom:
        fieldRef:
          fieldPath: status.podIP
    - name: SERVICE_ACCOUNT
      valueFrom:
        fieldRef:
          fieldPath: spec.serviceAccountName
    - name: HOST_IP
      valueFrom:
        fieldRef:
          fieldPath: status.hostIP
  {{- if eq .Values.global.proxy.tracer "datadog" }}
  {{- if isset .ObjectMeta.Annotations `+"`"+`apm.datadoghq.com/env`+"`"+` }}
  {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `+"`"+`apm.datadoghq.com/env`+"`"+`) }}
    - name: {{ $key }}
      value: "{{ $value }}"
  {{- end }}
  {{- end }}
  {{- end }}
    - name: ISTIO_META_POD_PORTS
      value: |-
        [
        {{- $first := true }}
        {{- range $index1, $c := .Spec.Containers }}
          {{- range $index2, $p := $c.Ports }}
            {{- if (structToJSON $p) }}
            {{if not $first}},{{end}}{{ structToJSON $p }}
            {{- $first = false }}
            {{- end }}
          {{- end}}
        {{- end}}
        ]
    - name: ISTIO_META_APP_CONTAINERS
      value: |-
        [
          {{- range $index, $container := .Spec.Containers }}
            {{- if ne $index 0}},{{- end}}
            {{ $container.Name }}
          {{- end}}
        ]
    - name: ISTIO_META_CLUSTER_ID
      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `+"`"+`Kubernetes`+"`"+` }}"
    - name: ISTIO_META_POD_NAME
      valueFrom:
        fieldRef:
          fieldPath: metadata.name
    - name: ISTIO_META_CONFIG_NAMESPACE
      valueFrom:
        fieldRef:
          fieldPath: metadata.namespace
    - name: ISTIO_META_INTERCEPTION_MODE
      value: "{{ or (index .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/interceptionMode`+"`"+`) .ProxyConfig.InterceptionMode.String }}"
    {{- if .Values.global.network }}
    - name: ISTIO_META_NETWORK
      value: "{{ .Values.global.network }}"
    {{- end }}
    {{ if .ObjectMeta.Annotations }}
    - name: ISTIO_METAJSON_ANNOTATIONS
      value: |
             {{ toJSON .ObjectMeta.Annotations }}
    {{ end }}
    {{- if .DeploymentMeta.Name }}
    - name: ISTIO_META_WORKLOAD_NAME
      value: {{ .DeploymentMeta.Name }}
    {{ end }}
    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
    - name: ISTIO_META_OWNER
      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `+"`"+`default`+"`"+` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
    {{- end}}
    {{- if (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/bootstrapOverride`+"`"+`) }}
    - name: ISTIO_BOOTSTRAP_OVERRIDE
      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
    {{- end }}
    {{- if .Values.global.meshID }}
    - name: ISTIO_META_MESH_ID
      value: "{{ .Values.global.meshID }}"
    {{- else if .Values.global.trustDomain }}
    - name: ISTIO_META_MESH_ID
      value: "{{ .Values.global.trustDomain }}"
    {{- end }}
    {{- if eq .Values.global.proxy.tracer "stackdriver" }}
    - name: STACKDRIVER_TRACING_ENABLED
      value: "true"
    - name: STACKDRIVER_TRACING_DEBUG
      value: "{{ .ProxyConfig.GetTracing.GetStackdriver.GetDebug }}"
    - name: STACKDRIVER_TRACING_MAX_NUMBER_OF_ANNOTATIONS
      value: "{{ .ProxyConfig.GetTracing.GetStackdriver.GetMaxNumberOfAnnotations.Value }}"
    - name: STACKDRIVER_TRACING_MAX_NUMBER_OF_ATTRIBUTES
      value: "{{ .ProxyConfig.GetTracing.GetStackdriver.GetMaxNumberOfAttributes.Value }}"
    - name: STACKDRIVER_TRACING_MAX_NUMBER_OF_MESSAGE_EVENTS
      value: "{{ .ProxyConfig.GetTracing.GetStackdriver.GetMaxNumberOfMessageEvents.Value }}"
    {{- end }}
    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `+"`"+`apm.datadoghq.com/env`+"`"+`) }}
    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `+"`"+`apm.datadoghq.com/env`+"`"+`) }}
      - name: {{ $key }}
        value: "{{ $value }}"
    {{- end }}
    {{- end }}
    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
    - name: {{ $key }}
      value: "{{ $value }}"
    {{- end }}
    imagePullPolicy: "{{ valueOrDefault .Values.global.imagePullPolicy `+"`"+`Always`+"`"+` }}"
    {{ if ne (annotation .ObjectMeta `+"`"+`status.sidecar.istio.io/port`+"`"+` .Values.global.proxy.statusPort) `+"`"+`0`+"`"+` }}
    readinessProbe:
      httpGet:
        path: /healthz/ready
        port: {{ annotation .ObjectMeta `+"`"+`status.sidecar.istio.io/port`+"`"+` .Values.global.proxy.statusPort }}
      initialDelaySeconds: {{ annotation .ObjectMeta `+"`"+`readiness.status.sidecar.istio.io/initialDelaySeconds`+"`"+` .Values.global.proxy.readinessInitialDelaySeconds }}
      periodSeconds: {{ annotation .ObjectMeta `+"`"+`readiness.status.sidecar.istio.io/periodSeconds`+"`"+` .Values.global.proxy.readinessPeriodSeconds }}
      failureThreshold: {{ annotation .ObjectMeta `+"`"+`readiness.status.sidecar.istio.io/failureThreshold`+"`"+` .Values.global.proxy.readinessFailureThreshold }}
    {{ end -}}
    securityContext:
      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
      capabilities:
        {{ if or (eq (annotation .ObjectMeta `+"`"+`sidecar.istio.io/interceptionMode`+"`"+` .ProxyConfig.InterceptionMode) `+"`"+`TPROXY`+"`"+`) (eq (annotation .ObjectMeta `+"`"+`sidecar.istio.io/capNetBindService`+"`"+` .Values.global.proxy.capNetBindService) `+"`"+`true`+"`"+`) -}}
        add:
        {{ if eq (annotation .ObjectMeta `+"`"+`sidecar.istio.io/interceptionMode`+"`"+` .ProxyConfig.InterceptionMode) `+"`"+`TPROXY`+"`"+` -}}
        - NET_ADMIN
        {{- end }}
        {{ if eq (annotation .ObjectMeta `+"`"+`sidecar.istio.io/capNetBindService`+"`"+` .Values.global.proxy.capNetBindService) `+"`"+`true`+"`"+` -}}
        - NET_BIND_SERVICE
        {{- end }}
        {{- end }}
        drop:
        - ALL
      privileged: {{ .Values.global.proxy.privileged }}
      readOnlyRootFilesystem: {{ not .Values.global.proxy.enableCoreDump }}
      runAsGroup: 1337
      fsGroup: 1337
      {{ if or (eq (annotation .ObjectMeta `+"`"+`sidecar.istio.io/interceptionMode`+"`"+` .ProxyConfig.InterceptionMode) `+"`"+`TPROXY`+"`"+`) (eq (annotation .ObjectMeta `+"`"+`sidecar.istio.io/capNetBindService`+"`"+` .Values.global.proxy.capNetBindService) `+"`"+`true`+"`"+`) -}}
      runAsNonRoot: false
      runAsUser: 0
      {{- else -}}
      runAsNonRoot: true
      runAsUser: 1337
      {{- end }}
    resources:
  {{- if or (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyCPU`+"`"+`) (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyMemory`+"`"+`) (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyCPULimit`+"`"+`) (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyMemoryLimit`+"`"+`) }}
    {{- if or (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyCPU`+"`"+`) (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyMemory`+"`"+`) }}
      requests:
        {{ if (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyCPU`+"`"+`) -}}
        cpu: "{{ index .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyCPU`+"`"+` }}"
        {{ end }}
        {{ if (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyMemory`+"`"+`) -}}
        memory: "{{ index .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyMemory`+"`"+` }}"
        {{ end }}
    {{- end }}
    {{- if or (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyCPULimit`+"`"+`) (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyMemoryLimit`+"`"+`) }}
      limits:
        {{ if (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyCPULimit`+"`"+`) -}}
        cpu: "{{ index .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyCPULimit`+"`"+` }}"
        {{ end }}
        {{ if (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyMemoryLimit`+"`"+`) -}}
        memory: "{{ index .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/proxyMemoryLimit`+"`"+` }}"
        {{ end }}
    {{- end }}
  {{- else }}
    {{- if .Values.global.proxy.resources }}
      {{ toYaml .Values.global.proxy.resources | indent 4 }}
    {{- end }}
  {{- end }}
    volumeMounts:
    {{- if eq .Values.global.pilotCertProvider "istiod" }}
    - mountPath: /var/run/secrets/istio
      name: istiod-ca-cert
    {{- end }}
    - mountPath: /var/lib/istio/data
      name: istio-data
    {{ if (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/bootstrapOverride`+"`"+`) }}
    - mountPath: /etc/istio/custom-bootstrap
      name: custom-bootstrap-volume
    {{- end }}
    # SDS channel between istioagent and Envoy
    - mountPath: /etc/istio/proxy
      name: istio-envoy
    {{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
    - mountPath: /var/run/secrets/tokens
      name: istio-token
    {{- end }}
    {{- if .Values.global.mountMtlsCerts }}
    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
    - mountPath: /etc/certs/
      name: istio-certs
      readOnly: true
    {{- end }}
    - name: podinfo
      mountPath: /etc/istio/pod
    {{- if and (eq .Values.global.proxy.tracer "lightstep") .Values.global.tracer.lightstep.cacertPath }}
    - mountPath: {{ directory .ProxyConfig.GetTracing.GetLightstep.GetCacertPath }}
      name: lightstep-certs
      readOnly: true
    {{- end }}
      {{- if isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/userVolumeMount`+"`"+` }}
      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/userVolumeMount`+"`"+`) }}
    - name: "{{  $index }}"
      {{ toYaml $value | indent 4 }}
      {{ end }}
      {{- end }}
  volumes:
  {{- if (isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/bootstrapOverride`+"`"+`) }}
  - name: custom-bootstrap-volume
    configMap:
      name: {{ annotation .ObjectMeta `+"`"+`sidecar.istio.io/bootstrapOverride`+"`"+` "" }}
  {{- end }}
  # SDS channel between istioagent and Envoy
  - emptyDir:
      medium: Memory
    name: istio-envoy
  - name: istio-data
    emptyDir: {}
  - name: podinfo
    downwardAPI:
      items:
        - path: "labels"
          fieldRef:
            fieldPath: metadata.labels
        - path: "annotations"
          fieldRef:
            fieldPath: metadata.annotations
  {{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
  - name: istio-token
    projected:
      sources:
      - serviceAccountToken:
          path: istio-token
          expirationSeconds: 43200
          audience: {{ .Values.global.sds.token.aud }}
  {{- end }}
  {{- if eq .Values.global.pilotCertProvider "istiod" }}
  - name: istiod-ca-cert
    configMap:
      name: istio-ca-root-cert
  {{- end }}
  {{- if .Values.global.mountMtlsCerts }}
  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
  - name: istio-certs
    secret:
      optional: true
      {{ if eq .Spec.ServiceAccountName "" }}
      secretName: istio.default
      {{ else -}}
      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
      {{  end -}}
  {{- end }}
    {{- if isset .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/userVolume`+"`"+` }}
    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `+"`"+`sidecar.istio.io/userVolume`+"`"+`) }}
  - name: "{{ $index }}"
    {{ toYaml $value | indent 2 }}
    {{ end }}
    {{ end }}
  {{- if and (eq .Values.global.proxy.tracer "lightstep") .Values.global.tracer.lightstep.cacertPath }}
  - name: lightstep-certs
    secret:
      optional: true
      secretName: lightstep.cacert
  {{- end }}
  {{- if .Values.global.podDNSSearchNamespaces }}
  dnsConfig:
    searches:
      {{- range .Values.global.podDNSSearchNamespaces }}
      - {{ render . }}
      {{- end }}
  {{- end }}
  podRedirectAnnot:
    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `+"`"+`sidecar.istio.io/interceptionMode`+"`"+` .ProxyConfig.InterceptionMode }}"
    traffic.sidecar.istio.io/includeOutboundIPRanges: "{{ annotation .ObjectMeta `+"`"+`traffic.sidecar.istio.io/includeOutboundIPRanges`+"`"+` .Values.global.proxy.includeIPRanges }}"
    traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{ annotation .ObjectMeta `+"`"+`traffic.sidecar.istio.io/excludeOutboundIPRanges`+"`"+` .Values.global.proxy.excludeIPRanges }}"
    traffic.sidecar.istio.io/includeInboundPorts: "{{ annotation .ObjectMeta `+"`"+`traffic.sidecar.istio.io/includeInboundPorts`+"`"+` (includeInboundPorts .Spec.Containers) }}"
    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `+"`"+`status.sidecar.istio.io/port`+"`"+` .Values.global.proxy.statusPort) (annotation .ObjectMeta `+"`"+`traffic.sidecar.istio.io/excludeInboundPorts`+"`"+` .Values.global.proxy.excludeInboundPorts) }}"
  {{ if or (isset .ObjectMeta.Annotations `+"`"+`traffic.sidecar.istio.io/excludeOutboundPorts`+"`"+`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `+"`"+`traffic.sidecar.istio.io/excludeOutboundPorts`+"`"+` .Values.global.proxy.excludeOutboundPorts }}"
  {{- end }}
    traffic.sidecar.istio.io/kubevirtInterfaces: "{{ index .ObjectMeta.Annotations `+"`"+`traffic.sidecar.istio.io/kubevirtInterfaces`+"`"+` }}"
`)

func chartsIstioControlIstioDiscoveryFilesInjectionTemplateYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryFilesInjectionTemplateYaml, nil
}

func chartsIstioControlIstioDiscoveryFilesInjectionTemplateYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryFilesInjectionTemplateYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/files/injection-template.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplates_affinityTpl = []byte(`{{/* affinity - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ */}}

{{- define "nodeaffinity" }}
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityRequiredDuringScheduling" . }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityPreferredDuringScheduling" . }}
{{- end }}

{{- define "nodeAffinityRequiredDuringScheduling" }}
      nodeSelectorTerms:
      - matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
        {{- range $key, $val := .Values.global.arch }}
          {{- if gt ($val | int) 0 }}
          - {{ $key | quote }}
          {{- end }}
        {{- end }}
        {{- $nodeSelector := default .Values.global.defaultNodeSelector .Values.pilot.nodeSelector -}}
        {{- range $key, $val := $nodeSelector }}
        - key: {{ $key }}
          operator: In
          values:
          - {{ $val | quote }}
        {{- end }}
{{- end }}

{{- define "nodeAffinityPreferredDuringScheduling" }}
  {{- range $key, $val := .Values.global.arch }}
    {{- if gt ($val | int) 0 }}
    - weight: {{ $val | int }}
      preference:
        matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
          - {{ $key | quote }}
    {{- end }}
  {{- end }}
{{- end }}

{{- define "podAntiAffinity" }}
{{- if or .Values.pilot.podAntiAffinityLabelSelector .Values.pilot.podAntiAffinityTermLabelSelector}}
  podAntiAffinity:
    {{- if .Values.pilot.podAntiAffinityLabelSelector }}
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityRequiredDuringScheduling" . }}
    {{- end }}
    {{- if .Values.pilot.podAntiAffinityTermLabelSelector }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityPreferredDuringScheduling" . }}
    {{- end }}
{{- end }}
{{- end }}

{{- define "podAntiAffinityRequiredDuringScheduling" }}
    {{- range $index, $item := .Values.pilot.podAntiAffinityLabelSelector }}
    - labelSelector:
        matchExpressions:
        - key: {{ $item.key }}
          operator: {{ $item.operator }}
          {{- if $item.values }}
          values:
          {{- $vals := split "," $item.values }}
          {{- range $i, $v := $vals }}
          - {{ $v | quote }}
          {{- end }}
          {{- end }}
      topologyKey: {{ $item.topologyKey }}
    {{- end }}
{{- end }}

{{- define "podAntiAffinityPreferredDuringScheduling" }}
    {{- range $index, $item := .Values.pilot.podAntiAffinityTermLabelSelector }}
    - podAffinityTerm:
        labelSelector:
          matchExpressions:
          - key: {{ $item.key }}
            operator: {{ $item.operator }}
            {{- if $item.values }}
            values:
            {{- $vals := split "," $item.values }}
            {{- range $i, $v := $vals }}
            - {{ $v | quote }}
            {{- end }}
            {{- end }}
        topologyKey: {{ $item.topologyKey }}
      weight: 100
    {{- end }}
{{- end }}
`)

func chartsIstioControlIstioDiscoveryTemplates_affinityTplBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplates_affinityTpl, nil
}

func chartsIstioControlIstioDiscoveryTemplates_affinityTpl() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplates_affinityTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/_affinity.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplates_helpersTpl = []byte(``)

func chartsIstioControlIstioDiscoveryTemplates_helpersTplBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplates_helpersTpl, nil
}

func chartsIstioControlIstioDiscoveryTemplates_helpersTpl() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplates_helpersTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/_helpers.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplatesAutoscaleYaml = []byte(`{{ if or (eq .Values.revision "") (not .Values.clusterResources) }}
{{- if and .Values.pilot.autoscaleEnabled .Values.pilot.autoscaleMin .Values.pilot.autoscaleMax }}
apiVersion: autoscaling/v2beta1
kind: HorizontalPodAutoscaler
metadata:
  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  namespace: {{ .Release.Namespace }}
  labels:
    app: istiod
    release: {{ .Release.Name }}
spec:
  maxReplicas: {{ .Values.pilot.autoscaleMax }}
  minReplicas: {{ .Values.pilot.autoscaleMin }}
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  metrics:
  - type: Resource
    resource:
      name: cpu
      targetAverageUtilization: {{ .Values.pilot.cpu.targetAverageUtilization }}
---
{{- end }}
{{- end }}
`)

func chartsIstioControlIstioDiscoveryTemplatesAutoscaleYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplatesAutoscaleYaml, nil
}

func chartsIstioControlIstioDiscoveryTemplatesAutoscaleYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplatesAutoscaleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/autoscale.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplatesClusterroleGalleyDisableWebhookYaml = []byte(`{{ if .Values.clusterResources }}
{{/* If we have Istiod enabled and Galley disabled, we may run into issues during upgrade. */}}
{{/* The old Galley will continuely try to patch its webhook, when we actually want to remove it. */}}
{{/* This will disable Galley's permission to do so, if galley is disabled. */}}
{{- if and .Values.global.istiod.enabled (not .Values.galley.enabled) }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-galley-{{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
rules:
  # For reading Istio resources
  - apiGroups: [
    "authentication.istio.io",
    "config.istio.io",
    "networking.istio.io",
    "rbac.istio.io",
    "security.istio.io"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]
    # For updating Istio resource statuses
  - apiGroups: [
    "authentication.istio.io",
    "config.istio.io",
    "networking.istio.io",
    "rbac.istio.io",
    "security.istio.io"]
    resources: ["*/status"]
    verbs: ["update"]

    # Remove galley's permissions to reconcile the validation config when istiod is present.
    # Notably missing here is the permission to modify webhooks.

  - apiGroups: ["extensions","apps"]
    resources: ["deployments"]
    resourceNames: ["istio-galley"]
    verbs: ["get"]
  - apiGroups: [""]
    resources: ["pods", "nodes", "services", "endpoints", "namespaces"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources: ["deployments/finalizers"]
    resourceNames: ["istio-galley"]
    verbs: ["update"]
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["clusterroles"]
    verbs: ["get", "list", "watch"]
---
{{- end }}
{{- end }}
`)

func chartsIstioControlIstioDiscoveryTemplatesClusterroleGalleyDisableWebhookYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplatesClusterroleGalleyDisableWebhookYaml, nil
}

func chartsIstioControlIstioDiscoveryTemplatesClusterroleGalleyDisableWebhookYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplatesClusterroleGalleyDisableWebhookYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/clusterrole-galley-disable-webhook.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplatesClusterroleYaml = []byte(`{{ if .Values.clusterResources }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-pilot-{{ .Release.Namespace }}
  labels:
    app: pilot
    release: {{ .Release.Name }}
rules:
- apiGroups: ["config.istio.io", "rbac.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io"]
  verbs: ["get", "watch", "list"]
  resources: ["*"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["get", "watch", "list"]
- apiGroups: ["extensions"]
  resources: ["ingresses"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["extensions"]
  resources: ["ingresses/status"]
  verbs: ["*"]
  # TODO: remove, too broad permission, should be namespace only
- apiGroups: [""]
  resources: ["configmaps"]
  # Create and update needed for ingress election
  verbs: ["get", "list", "watch", "create", "update"]
- apiGroups: [""]
  resources: ["endpoints", "pods", "services", "namespaces", "nodes", "secrets"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["create", "get", "watch", "list", "update", "delete"]
- apiGroups: ["certificates.k8s.io"]
  resources:
    - "certificatesigningrequests"
    - "certificatesigningrequests/approval"
    - "certificatesigningrequests/status"
  verbs: ["update", "create", "get", "delete", "watch"]
- apiGroups: ["discovery.k8s.io"]
  resources: ["endpointslices"]
  verbs: ["get", "list", "watch"]
---
# Dedicated cluster role - istiod will use fewer dangerous permissions ( secret access in particular ).
# TODO: separate cluster role with the minimal set of permissions needed for a 'tenant' Istiod
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istiod-{{ .Release.Namespace }}
  labels:
    app: istiod
    release: {{ .Release.Name }}
rules:
{{- if .Values.global.istiod.enabled }}
  # Remove permissions to reconcile webhook configuration. This address the downgrade case
  # where istiod will be uninstalled. Removing the permissions reduces
  # the likelihood that istiod will reconcile something it shouldn't.

  # sidecar injection controller
  - apiGroups: ["admissionregistration.k8s.io"]
    resources: ["mutatingwebhookconfigurations"]
    verbs: ["get", "list", "watch", "patch"]

  # configuration validation webhook controller
  - apiGroups: ["admissionregistration.k8s.io"]
    resources: ["validatingwebhookconfigurations"]
    verbs: ["get", "list", "watch", "update"]
{{ end }}

  # permissions to verify the webhook is ready and rejecting
  # invalid config. We use --server-dry-run so no config is persisted.
  - apiGroups: ["networking.istio.io"]
    verbs: ["create"]
    resources: ["gateways"]

  # istio configuration
  - apiGroups: ["config.istio.io", "rbac.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io"]
    verbs: ["get", "watch", "list"]
    resources: ["*"]

  # auto-detect installed CRD definitions
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["get", "list", "watch"]

  # discovery and routing
  - apiGroups: ["extensions","apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["discovery.k8s.io"]
    resources: ["endpointslices"]
    verbs: ["get", "list", "watch"]

  # ingress controller
  - apiGroups: ["extensions"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources: ["ingresses/status"]
    verbs: ["*"]

  # required for CA's namespace controller
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["create", "get", "list", "watch", "update"]

  # Istiod and bootstrap.
  - apiGroups: ["certificates.k8s.io"]
    resources:
      - "certificatesigningrequests"
      - "certificatesigningrequests/approval"
      - "certificatesigningrequests/status"
    verbs: ["update", "create", "get", "delete", "watch"]
  # Used by Istiod to verify the JWT tokens
  - apiGroups: ["authentication.k8s.io"]
    resources: ["tokenreviews"]
    verbs: ["create"]

  # TODO: remove, no longer needed at cluster
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["create", "get", "watch", "list", "update", "delete"]
  - apiGroups: [""]
    resources: ["serviceaccounts"]
    verbs: ["get", "watch", "list"]
{{ end }}`)

func chartsIstioControlIstioDiscoveryTemplatesClusterroleYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplatesClusterroleYaml, nil
}

func chartsIstioControlIstioDiscoveryTemplatesClusterroleYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplatesClusterroleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/clusterrole.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplatesClusterrolebindingYaml = []byte(`{{ if .Values.clusterResources }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-pilot-{{ .Release.Namespace }}
  labels:
    app: pilot
    release: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istio-pilot-{{ .Release.Namespace }}
subjects:
  - kind: ServiceAccount
    name: istio-pilot-service-account
    namespace: {{ .Release.Namespace }}
---
{{ if .Values.global.istiod.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istiod-{{ .Release.Namespace }}
  labels:
    app: istiod
    release: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istiod-{{ .Release.Namespace }}
subjects:
  - kind: ServiceAccount
    name: istio-pilot-service-account
    namespace: {{ .Release.Namespace }}

---
{{ end }}
{{ end }}
`)

func chartsIstioControlIstioDiscoveryTemplatesClusterrolebindingYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplatesClusterrolebindingYaml, nil
}

func chartsIstioControlIstioDiscoveryTemplatesClusterrolebindingYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplatesClusterrolebindingYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/clusterrolebinding.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplatesConfigmapEnvoyYaml = []byte(`{{ if or (eq .Values.revision "") (not .Values.clusterResources) }}
apiVersion: v1
kind: ConfigMap
metadata:
  namespace: {{ .Release.Namespace }}
  name: pilot-envoy-config{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  labels:
    release: {{ .Release.Name }}
data:
  envoy.yaml.tmpl: |-
    admin:
      access_log_path: /dev/null
      address:
        socket_address:
          address: 127.0.0.1
          port_value: 15000

    static_resources:
      clusters:
      - name: in.15010
        http2_protocol_options: {}
        connect_timeout: 1.000s

        hosts:
        - socket_address:
            address: 127.0.0.1
            port_value: 15010

        circuit_breakers:
          thresholds:
          - max_connections: 100000
            max_pending_requests: 100000
            max_requests: 100000
            max_retries: 3

    # TODO: telemetry using EDS
    # TODO: other pilots using EDS, load balancing
    # TODO: galley using EDS

      - name: out.galley.15019
        http2_protocol_options: {}
        connect_timeout: 1.000s
        type: STRICT_DNS

        circuit_breakers:
          thresholds:
            - max_connections: 100000
              max_pending_requests: 100000
              max_requests: 100000
              max_retries: 3

        tls_context:
          common_tls_context:
            tls_certificates:
            - certificate_chain:
                filename: /etc/certs/cert-chain.pem
              private_key:
                filename: /etc/certs/key.pem
            validation_context:
              trusted_ca:
                filename: /etc/certs/root-cert.pem
              verify_subject_alt_name:
              - spiffe://{{ .Values.global.trustDomain }}/ns/{{ .Values.global.configNamespace }}/sa/istio-galley-service-account

        hosts:
          - socket_address:
              address: istio-galley.{{ .Values.global.configNamespace }}
              port_value: 15019


      listeners:
      - name: "in.15011"
        address:
          socket_address:
            address: 0.0.0.0
            port_value: 15011
        filter_chains:
        - filters:
          - name: envoy.http_connection_manager
            #typed_config
            #"@type": "type.googleapis.com/",
            config:
              codec_type: HTTP2
              stat_prefix: "15011"
              stream_idle_timeout: 0s
              http2_protocol_options:
                max_concurrent_streams: 1073741824

              access_log:
              - name: envoy.file_access_log
                config:
                  path: /dev/stdout

              http_filters:
              - name: envoy.router

              route_config:
                name: "15011"

                virtual_hosts:
                - name: istio-pilot

                  domains:
                  - '*'

                  routes:
                  - match:
                      prefix: /
                    route:
                      cluster: in.15010
                      timeout: 0.000s
                    decorator:
                      operation: xDS

          tls_context:
            require_client_certificate: true
            common_tls_context:
              validation_context:
                trusted_ca:
                  filename: /etc/certs/root-cert.pem

              alpn_protocols:
              - h2

              tls_certificates:
              - certificate_chain:
                  filename: /etc/certs/cert-chain.pem
                private_key:
                  filename: /etc/certs/key.pem


      # Manual 'whitebox' mode
      - name: "local.15019"
        address:
          socket_address:
            address: 127.0.0.1
            port_value: 15019
        filter_chains:
          - filters:
              - name: envoy.http_connection_manager
                config:
                  codec_type: HTTP2
                  stat_prefix: "15019"
                  stream_idle_timeout: 0s
                  http2_protocol_options:
                    max_concurrent_streams: 1073741824

                  access_log:
                    - name: envoy.file_access_log
                      config:
                        path: /dev/stdout

                  http_filters:
                    - name: envoy.router

                  route_config:
                    name: "15019"

                    virtual_hosts:
                      - name: istio-galley

                        domains:
                          - '*'

                        routes:
                          - match:
                              prefix: /
                            route:
                              cluster: out.galley.15019
                              timeout: 0.000s

---
{{- end }}
`)

func chartsIstioControlIstioDiscoveryTemplatesConfigmapEnvoyYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplatesConfigmapEnvoyYaml, nil
}

func chartsIstioControlIstioDiscoveryTemplatesConfigmapEnvoyYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplatesConfigmapEnvoyYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/configmap-envoy.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplatesConfigmapJwksYaml = []byte(`{{ if or (eq .Values.revision "") (not .Values.clusterResources) }}
{{- if .Values.pilot.jwksResolverExtraRootCA }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
data:
  extra.pem: {{ .Values.pilot.jwksResolverExtraRootCA | quote }}
{{- end }}
{{- end }}
`)

func chartsIstioControlIstioDiscoveryTemplatesConfigmapJwksYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplatesConfigmapJwksYaml, nil
}

func chartsIstioControlIstioDiscoveryTemplatesConfigmapJwksYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplatesConfigmapJwksYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/configmap-jwks.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplatesConfigmapYaml = []byte(`{{ if or (eq .Values.revision "") (not .Values.clusterResources) }}
{{- if .Values.pilot.configMap }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
data:

  # Configuration file for the mesh networks to be used by the Split Horizon EDS.
  meshNetworks: |-
  {{- if .Values.global.meshNetworks }}
    networks:
{{ toYaml .Values.global.meshNetworks | trim | indent 6 }}
  {{- else }}
    networks: {}
  {{- end }}

  values.yaml: |-
{{ toYaml .Values.pilot | trim | indent 4 }}

  mesh: |-
    {{- if .Values.global.enableTracing }}
    # Set enableTracing to false to disable request tracing.
    enableTracing: {{ .Values.global.enableTracing }}
    {{- end }}

    # Set accessLogFile to empty string to disable access log.
    accessLogFile: "{{ .Values.global.proxy.accessLogFile }}"

    accessLogFormat: {{ .Values.global.proxy.accessLogFormat | quote }}

    accessLogEncoding: '{{ .Values.global.proxy.accessLogEncoding }}'

    enableEnvoyAccessLogService: {{ .Values.global.proxy.envoyAccessLogService.enabled }}

    {{- if .Values.global.remotePolicyAddress }}
    {{- if .Values.global.createRemoteSvcEndpoints }}
    mixerCheckServer: istio-policy.{{ .Release.Namespace }}:15004
    {{- else }}
    mixerCheckServer: {{ .Values.global.remotePolicyAddress }}:15004
    {{- end }}
    {{- end }}
    {{- if .Values.global.remoteTelemetryAddress }}
    {{- if .Values.global.createRemoteSvcEndpoints }}
    mixerReportServer: istio-telemetry.{{ .Release.Namespace }}:15004
    {{- else }}
    mixerReportServer: {{ .Values.global.remoteTelemetryAddress }}:15004
    {{- end }}

    {{- else }}

    {{- if .Values.mixer.policy.enabled }}
    {{- if .Values.global.controlPlaneSecurityEnabled }}
    mixerCheckServer: istio-policy.{{ .Values.global.policyNamespace }}.svc.{{ .Values.global.proxy.clusterDomain }}:15004
    {{- else }}
    mixerCheckServer: istio-policy.{{ .Values.global.policyNamespace }}.svc.{{ .Values.global.proxy.clusterDomain }}:9091
    {{- end }}
    {{- end }}

    {{- if and .Values.telemetry.v1.enabled .Values.telemetry.enabled }}
    {{- if .Values.global.controlPlaneSecurityEnabled }}
    mixerReportServer: istio-telemetry.{{ .Values.global.telemetryNamespace }}.svc.{{ .Values.global.proxy.clusterDomain }}:15004
    {{- else }}
    mixerReportServer: istio-telemetry.{{ .Values.global.telemetryNamespace }}.svc.{{ .Values.global.proxy.clusterDomain }}:9091
    {{- end }}
    {{- end }}

    {{- end }}

    {{- if or .Values.mixer.policy.enabled .Values.global.remotePolicyAddress }}
    # policyCheckFailOpen allows traffic in cases when the mixer policy service cannot be reached.
    # Default is false which means the traffic is denied when the client is unable to connect to Mixer.
    policyCheckFailOpen: {{ .Values.global.policyCheckFailOpen }}
    {{- end }}

    {{- if .Values.mixer.telemetry.reportBatchMaxEntries }}
    # reportBatchMaxEntries is the number of requests that are batched before telemetry data is sent to the mixer server
    reportBatchMaxEntries: {{ .Values.mixer.telemetry.reportBatchMaxEntries }}
    {{- end }}

    {{- if .Values.mixer.telemetry.reportBatchMaxTime }}
    # reportBatchMaxTime is the max waiting time before the telemetry data of a request is sent to the mixer server
    reportBatchMaxTime: {{ .Values.mixer.telemetry.reportBatchMaxTime }}
    {{- end }}

    {{- if .Values.mixer.telemetry.sessionAffinityEnabled }}
    # sidecarToTelemetrySessionAffinity will create a STRICT_DNS type cluster for istio-telemetry.
    sidecarToTelemetrySessionAffinity: {{ .Values.mixer.telemetry.sessionAffinityEnabled }}
    {{- end }}

    {{- if .Values.telemetry.v2.enabled }}
    disableMixerHttpReports: true
    {{- else }}
    disableMixerHttpReports: false
    {{- end }}

    # Set the following variable to true to disable policy checks by the Mixer.
    # Note that metrics will still be reported to the Mixer.
    {{- if .Values.mixer.policy.enabled }}
    disablePolicyChecks: {{ .Values.global.disablePolicyChecks }}
    {{- else }}
    disablePolicyChecks: true
    {{- end }}

    # Automatic protocol detection uses a set of heuristics to
    # determine whether the connection is using TLS or not (on the
    # server side), as well as the application protocol being used
    # (e.g., http vs tcp). These heuristics rely on the client sending
    # the first bits of data. For server first protocols like MySQL,
    # MongoDB, etc., Envoy will timeout on the protocol detection after
    # the specified period, defaulting to non mTLS plain TCP
    # traffic. Set this field to tweak the period that Envoy will wait
    # for the client to send the first bits of data. (MUST BE >=1ms)
    protocolDetectionTimeout: {{ .Values.global.proxy.protocolDetectionTimeout }}

    # This is the k8s ingress service name, update if you used a different name
    {{- if .Values.pilot.ingress }}
    {{- if .Values.pilot.ingress.ingressService }}
    ingressService: "{{ .Values.pilot.ingress.ingressService }}"
    ingressControllerMode: "{{ .Values.pilot.ingress.ingressControllerMode }}"
    ingressClass: "{{ .Values.pilot.ingress.ingressClass }}"
    {{- end }}
    {{- end }}

    # The trust domain corresponds to the trust root of a system.
    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
    trustDomain: {{ .Values.global.trustDomain | quote }}

    #  The trust domain aliases represent the aliases of trust_domain.
    #  For example, if we have
    #  trustDomain: td1
    #  trustDomainAliases: [“td2”, "td3"]
    #  Any service with the identity "td1/ns/foo/sa/a-service-account", "td2/ns/foo/sa/a-service-account",
    #  or "td3/ns/foo/sa/a-service-account" will be treated the same in the Istio mesh.
    trustDomainAliases:
      {{- range .Values.global.trustDomainAliases }}
      - {{ . | quote }}
      {{- end }}

    {{- if .Values.global.istiod.enabled }}

    # Used by pilot-agent
    sdsUdsPath: "unix:/etc/istio/proxy/SDS"

    {{- else }}

    # Set expected values when SDS is disabled
    # Unix Domain Socket through which envoy communicates with NodeAgent SDS to get
    # key/cert for mTLS. Use secret-mount files instead of SDS if set to empty.
    sdsUdsPath: ""

    # This flag is used by secret discovery service(SDS).
    # If set to true(prerequisite: https://kubernetes.io/docs/concepts/storage/volumes/#projected), Istio will inject volumes mount
    # for k8s service account JWT, so that K8s API server mounts k8s service account JWT to envoy container, which
    # will be used to generate key/cert eventually. This isn't supported for non-k8s case.
    enableSdsTokenMount: false

    # This flag is used by secret discovery service(SDS).
    # If set to true, envoy will fetch normal k8s service account JWT from '/var/run/secrets/kubernetes.io/serviceaccount/token'
    # (https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod)
    # and pass to sds server, which will be used to request key/cert eventually.
    # this flag is ignored if enableSdsTokenMount is set.
    # This isn't supported for non-k8s case.
    sdsUseK8sSaJwt: false
    {{- end }}

    # If true, automatically configure client side mTLS settings to match the corresponding service's
    # server side mTLS authentication policy, when destination rule for that service does not specify
    # TLS settings.
    enableAutoMtls: {{ .Values.global.mtls.auto }}

    {{- if .Values.global.useMCP }}
    configSources:
    {{- if .Values.global.controlPlaneSecurityEnabled }}
    - address: localhost:15019
    {{- else }}
    - address: istio-galley.{{ .Values.global.configNamespace }}:9901
    {{- end }}
    {{- if .Values.pilot.configSource.subscribedResources }}
      subscribedResources:
    {{- range .Values.pilot.configSource.subscribedResources }}
        - {{ . }}
    {{- end }}
    {{- end}}
    {{- end }}

    outboundTrafficPolicy:
      mode: {{ .Values.global.outboundTrafficPolicy.mode }}

    {{- if  .Values.global.localityLbSetting.enabled }}
    localityLbSetting:
{{ toYaml .Values.global.localityLbSetting | trim | indent 6 }}
    {{- end }}

    # Configures DNS certificates provisioned through Chiron linked into Pilot.
    # The DNS certificate provisioning is enabled by default now so it get tested.
    # TODO (lei-tang): we'll decide whether enable it by default or not before Istio 1.4 Release.
    certificates:
{{ toYaml .Values.global.certificates | trim | indent 6 }}

    defaultConfig:
      #
      # TCP connection timeout between Envoy & the application, and between Envoys.
      connectTimeout: 10s
      #
      ### ADVANCED SETTINGS #############
      # Where should envoy's configuration be stored in the istio-proxy container
      configPath: "/etc/istio/proxy"
      # The pseudo service name used for Envoy.
      serviceCluster: istio-proxy
      # These settings that determine how long an old Envoy
      # process should be kept alive after an occasional reload.
      drainDuration: 45s
      parentShutdownDuration: 1m0s
      #
      # Port where Envoy listens (on local host) for admin commands
      # You can exec into the istio-proxy container in a pod and
      # curl the admin port (curl http://localhost:15000/) to obtain
      # diagnostic information from Envoy. See
      # https://lyft.github.io/envoy/docs/operations/admin.html
      # for more details
      proxyAdminPort: 15000
      #
      # Set concurrency to a specific number to control the number of Proxy worker threads.
      # If set to 0 (default), then start worker thread for each CPU thread/core.
      concurrency: {{ .Values.global.proxy.concurrency }}
      #
      {{- if eq .Values.global.proxy.tracer "lightstep" }}
      tracing:
        lightstep:
          # Address of the LightStep Satellite pool
          address: {{ .Values.global.tracer.lightstep.address }}
          # Access Token used to communicate with the Satellite pool
          accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
          # Whether communication with the Satellite pool should be secure
          secure: {{ .Values.global.tracer.lightstep.secure }}
          # Path to the file containing the cacert to use when verifying TLS
          cacertPath: {{ .Values.global.tracer.lightstep.cacertPath }}
      {{- else if eq .Values.global.proxy.tracer "zipkin" }}
      tracing:
        zipkin:
          # Address of the Zipkin collector
        {{- if .Values.global.tracer.zipkin.address }}
          address: {{ .Values.global.tracer.zipkin.address }}
        {{- else }}
          address: zipkin.{{ .Values.global.telemetryNamespace }}:9411
        {{- end }}
      {{- else if eq .Values.global.proxy.tracer "datadog" }}
      tracing:
        datadog:
          # Address of the Datadog Agent
          address: {{ .Values.global.tracer.datadog.address }}
      {{- else if eq .Values.global.proxy.tracer "stackdriver" }}
      tracing:
        stackdriver:
          # enables trace output to stdout.
        {{- if $.Values.global.tracer.stackdriver.debug }}
          debug: {{ $.Values.global.tracer.stackdriver.debug }}
        {{- end }}
        {{- if $.Values.global.tracer.stackdriver.maxNumberOfAttributes }}
          # The global default max number of attributes per span.
          maxNumberOfAttributes: {{ $.Values.global.tracer.stackdriver.maxNumberOfAttributes }}
        {{- end }}
        {{- if $.Values.global.tracer.stackdriver.maxNumberOfAnnotations }}
          # The global default max number of annotation events per span.
          maxNumberOfAnnotations: {{ $.Values.global.tracer.stackdriver.maxNumberOfAnnotations }}
        {{- end }}
        {{- if $.Values.global.tracer.stackdriver.maxNumberOfMessageEvents }}
          # The global default max number of message events per span.
          maxNumberOfMessageEvents: {{ $.Values.global.tracer.stackdriver.maxNumberOfMessageEvents }}
        {{- end }}
      {{- end }}

    {{- $defPilotHostname := printf "istio-pilot.%s" .Release.Namespace }}
    {{- $pilotAddress := .Values.global.remotePilotAddress | default $defPilotHostname }}
    {{- if .Values.global.istiod.enabled }}
      # If port is 15012, will use SDS.
      # controlPlaneAuthPolicy is for mounted secrets, will wait for the files.
      controlPlaneAuthPolicy: NONE
      {{- if .Values.global.remotePilotAddress }}
      discoveryAddress: {{ printf "istiod-remote.%s.svc" .Release.Namespace }}:15012
      {{- else }}
      discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
      {{- end }}

    {{- else if .Values.global.controlPlaneSecurityEnabled }}
      #
      # Mutual TLS authentication between sidecars and istio control plane.
      controlPlaneAuthPolicy: MUTUAL_TLS
      #
      # Address where istio Pilot service is running
      {{- if .Values.global.remotePilotAddress }}
      discoveryAddress: istio-pilot.{{ .Release.Namespace }}:15011
      {{- else }}
      discoveryAddress: {{ $pilotAddress }}:15011
      {{- end }}
    {{- else }}
      #
      # Mutual TLS authentication between sidecars and istio control plane.
      controlPlaneAuthPolicy: NONE
      #
      # Address where istio Pilot service is running
      {{- if .Values.global.remotePilotAddress }}
      discoveryAddress: istio-pilot.{{ .Release.Namespace }}:15010
      {{- else }}
      discoveryAddress: {{ $pilotAddress }}:15010
      {{- end }}
    {{- end }}

    {{- if .Values.global.proxy.envoyMetricsService.enabled }}
      #
      # Envoy's Metrics Service stats sink pushes Envoy metrics to a remote collector via the Metrics Service gRPC API.
      envoyMetricsService:
        address: {{ .Values.global.proxy.envoyMetricsService.host }}:{{ .Values.global.proxy.envoyMetricsService.port }}
      {{- if .Values.global.proxy.envoyMetricsService.tlsSettings }}
        tlsSettings:
{{ toYaml .Values.global.proxy.envoyMetricsService.tlsSettings | trim | indent 10 }}
      {{- end}}
      {{- if .Values.global.proxy.envoyMetricsService.tcpKeepalive }}
        tcpKeepalive:
{{ toYaml .Values.global.proxy.envoyMetricsService.tcpKeepalive | trim | indent 10 }}
      {{- end}}
    {{- end}}


    {{- if .Values.global.proxy.envoyAccessLogService.enabled }}
      #
      # Envoy's AccessLog Service pushes access logs to a remote collector via the Access Log Service gRPC API.
      envoyAccessLogService:
        address: {{ .Values.global.proxy.envoyAccessLogService.host }}:{{ .Values.global.proxy.envoyAccessLogService.port }}
      {{- if .Values.global.proxy.envoyAccessLogService.tlsSettings }}
        tlsSettings:
{{ toYaml .Values.global.proxy.envoyAccessLogService.tlsSettings | trim | indent 10 }}
      {{- end}}
      {{- if .Values.global.proxy.envoyAccessLogService.tcpKeepalive }}
        tcpKeepalive:
{{ toYaml .Values.global.proxy.envoyAccessLogService.tcpKeepalive | trim | indent 10 }}
      {{- end}}
    {{- end}}

---
{{- end }}
{{- end }}
`)

func chartsIstioControlIstioDiscoveryTemplatesConfigmapYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplatesConfigmapYaml, nil
}

func chartsIstioControlIstioDiscoveryTemplatesConfigmapYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplatesConfigmapYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/configmap.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplatesDeploymentYaml = []byte(`{{ if or (eq .Values.revision "") (not .Values.clusterResources) }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  namespace: {{ .Release.Namespace }}
  labels:
    app: istiod
    istio: pilot
    release: {{ .Release.Name }}
    {{- if ne .Values.revision ""}}
    version: {{ .Values.revision }}
    {{- end }}
{{- range $key, $val := .Values.pilot.deploymentLabels }}
    {{ $key }}: "{{ $val }}"
{{- end }}
spec:
{{- if not .Values.pilot.autoscaleEnabled }}
{{- if .Values.pilot.replicaCount }}
  replicas: {{ .Values.pilot.replicaCount }}
{{- end }}
{{- end }}
  strategy:
    rollingUpdate:
      maxSurge: {{ .Values.pilot.rollingMaxSurge }}
      maxUnavailable: {{ .Values.pilot.rollingMaxUnavailable }}
  selector:
    matchLabels:
      {{- if ne .Values.revision ""}}
      app: istiod
      version: {{ .Values.revision }}
      {{- end }}
      istio: pilot
  template:
    metadata:
      labels:
        app: istiod
        {{- if ne .Values.revision ""}}
        version: {{ .Values.revision }}
        {{- end }}
        # Label used by the 'default' service. For versioned deployments we match with app and version.
        # This avoids default deployment picking the canary
        istio: pilot
      annotations:
        sidecar.istio.io/inject: "false"
        {{- if .Values.pilot.podAnnotations }}
{{ toYaml .Values.pilot.podAnnotations | indent 8 }}
        {{- end }}
    spec:
      serviceAccountName: istio-pilot-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      securityContext:
        fsGroup: 1337
      containers:
        - name: discovery
{{- if contains "/" .Values.pilot.image }}
          image: "{{ .Values.pilot.image }}"
{{- else }}
          image: "{{ .Values.pilot.hub | default .Values.global.hub }}/{{ .Values.pilot.image | default "pilot" }}:{{ .Values.pilot.tag | default .Values.global.tag }}"
{{- end }}
          imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
          args:
          - "discovery"
          - --monitoringAddr=:15014
{{- if .Values.global.logging.level }}
          - --log_output_level={{ .Values.global.logging.level }}
{{- end}}
{{- if .Values.global.logAsJson }}
          - --log_as_json
{{- end }}
          - --domain
          - {{ .Values.global.proxy.clusterDomain }}
{{- if .Values.global.oneNamespace }}
          - "-a"
          - {{ .Release.Namespace }}
{{- end }}

{{- if and .Values.global.controlPlaneSecurityEnabled .Values.global.istiod.enabled }}
          - --secureGrpcAddr=:15011
{{- else }}
          - --secureGrpcAddr=
{{- end }}
{{- if .Values.global.trustDomain }}
          - --trust-domain={{ .Values.global.trustDomain }}
{{- end }}
{{- if .Values.pilot.plugins }}
          - --plugins={{ .Values.pilot.plugins }}
{{- end }}
          - --keepaliveMaxServerConnectionAge
          - "{{ .Values.pilot.keepaliveMaxServerConnectionAge }}"
          # TODO: make default
          - --disable-install-crds=true
          ports:
          - containerPort: 8080
          - containerPort: 15010
          - containerPort: 15017
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5
            timeoutSeconds: 5
          envFrom:
          # Allow an istiod configmap injecting user-specified env.
          - configMapRef:
              name: istiod
              optional: true
          env:
          - name: JWT_POLICY
            value: {{ .Values.global.jwtPolicy }}
          - name: PILOT_CERT_PROVIDER
            value: {{ .Values.global.pilotCertProvider }}
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: SERVICE_ACCOUNT
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: spec.serviceAccountName
          {{- if .Values.pilot.env }}
          {{- range $key, $val := .Values.pilot.env }}
          - name: {{ $key }}
            value: "{{ $val }}"
          {{- end }}
          {{- end }}
{{- if .Values.pilot.traceSampling }}
          - name: PILOT_TRACE_SAMPLING
            value: "{{ .Values.pilot.traceSampling }}"
{{- end }}
          - name: CONFIG_NAMESPACE
            value: {{ .Values.pilot.configNamespace }}
{{- if .Values.pilot.appNamespaces }}
          - name: APP_NAMESPACE
            value: {{ join "," .Values.pilot.appNamespaces }}
{{- end }}
          - name: PILOT_ENABLE_PROTOCOL_SNIFFING_FOR_OUTBOUND
            value: "{{ .Values.pilot.enableProtocolSniffingForOutbound }}"
          - name: PILOT_ENABLE_PROTOCOL_SNIFFING_FOR_INBOUND
            value: "{{ .Values.pilot.enableProtocolSniffingForInbound }}"
{{- if .Values.global.istiod.enabled }}
          - name: INJECTION_WEBHOOK_CONFIG_NAME
            value: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
          - name: ISTIOD_ADDR
            value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Release.Namespace }}.svc:15012
          - name: PILOT_EXTERNAL_GALLEY
            value: "false"
{{- end }}
          - name: CLUSTER_ID
            value: "{{ $.Values.global.multiCluster.clusterName | default `+"`"+`Kubernetes`+"`"+` }}"
          resources:
{{- if .Values.pilot.resources }}
{{ toYaml .Values.pilot.resources | trim | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
{{- end }}
          securityContext:
            runAsUser: 1337
            runAsGroup: 1337
            runAsNonRoot: true
            capabilities:
              drop:
              - ALL
          volumeMounts:
          - name: config-volume
            mountPath: /etc/istio/config
          {{- if .Values.global.istiod.enabled }}
          {{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
          - name: istio-token
            mountPath: /var/run/secrets/tokens
            readOnly: true
          {{- end }}
          - name: local-certs
            mountPath: /var/run/secrets/istio-dns
          - name: cacerts
            mountPath: /etc/cacerts
            readOnly: true
          - name: inject
            mountPath: /var/lib/istio/inject
            readOnly: true
          - name: istiod
            mountPath: /var/lib/istio/local
            readOnly: true
          {{- end }}
{{- if and .Values.global.controlPlaneSecurityEnabled (not .Values.global.istiod.enabled) }}
        - name: istio-proxy
{{- if contains "/" .Values.global.proxy.image }}
          image: "{{ .Values.global.proxy.image }}"
{{- else }}
          image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}"
{{- end }}
          imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
          ports:
          - containerPort: 15011
          args:
          - proxy
          - --domain
          - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
          - --serviceCluster
          - istio-pilot
          - --templateFile
          - /var/lib/envoy/envoy.yaml.tmpl
        {{- if .Values.global.controlPlaneSecurityEnabled}}
          - --controlPlaneAuthPolicy
          - MUTUAL_TLS
        {{- else }}
          - --controlPlaneAuthPolicy
          - NONE
        {{- end }}
        {{- if .Values.global.trustDomain }}
          - --trust-domain={{ .Values.global.trustDomain }}
        {{- end }}
        {{- if .Values.global.logAsJson }}
          - --log_as_json
        {{- end }}
          env:
          - name: JWT_POLICY
            value: {{ .Values.global.jwtPolicy }}
          - name: PILOT_CERT_PROVIDER
            value: {{ .Values.global.pilotCertProvider }}
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: INSTANCE_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.podIP
          resources:
{{- if .Values.global.proxy.resources }}
{{ toYaml .Values.global.proxy.resources | trim | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
{{- end }}
          volumeMounts:
{{- if and .Values.global.controlPlaneSecurityEnabled .Values.global.mountMtlsCerts }}
          - name: istio-certs
            mountPath: /etc/certs
            readOnly: true
{{- end }}
{{- if .Values.pilot.jwksResolverExtraRootCA }}
          - name: extracacerts
            mountPath: /cacerts
{{- end }}
          - name: pilot-envoy-config
            mountPath: /var/lib/envoy
{{- end }}
      volumes:
      {{- if .Values.global.istiod.enabled }}
      # Technically not needed on this pod - but it helps debugging/testing SDS
      # Should be removed after everything works.
      - emptyDir:
          medium: Memory
        name: local-certs
      {{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
      - name: istio-token
        projected:
          sources:
            - serviceAccountToken:
                audience: {{ .Values.global.sds.token.aud }}
                expirationSeconds: 43200
                path: istio-token
      {{- end }}
      - name: istiod
        configMap:
          name: istiod
          optional: true
      # Optional: user-generated root
      - name: cacerts
        secret:
          secretName: cacerts
          optional: true
      # Optional - image should have
      - name: inject
        configMap:
          name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
          optional: true
      {{- end }}

      - name: config-volume
        configMap:
          name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
      - name: pilot-envoy-config
        configMap:
          name: pilot-envoy-config{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  {{- if and .Values.global.controlPlaneSecurityEnabled .Values.global.mountMtlsCerts }}
      - name: istio-certs
        secret:
          secretName: istio.istio-pilot-service-account
          optional: true
  {{- end }}
  {{- if .Values.pilot.jwksResolverExtraRootCA }}
      - name: extracacerts
        configMap:
          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  {{- end }}
      affinity:
      {{- include "nodeaffinity" . | indent 6 }}
      {{- include "podAntiAffinity" . | indent 6 }}
{{- if .Values.pilot.tolerations }}
      tolerations:
{{ toYaml .Values.pilot.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}
---
{{- end }}
`)

func chartsIstioControlIstioDiscoveryTemplatesDeploymentYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplatesDeploymentYaml, nil
}

func chartsIstioControlIstioDiscoveryTemplatesDeploymentYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplatesDeploymentYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/deployment.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplatesEnableMeshMtlsYaml = []byte(`{{- /*

TODO(https://github.com/istio/istio/issues/18199) remove this configuration from charts once the operator starts managing it

*/ -}}

{{ if .Values.clusterResources }}
{{- if .Values.global.mtls.enabled }}

# Authentication policy to enable mutual TLS for all services (that have sidecar) in the mesh.
apiVersion: "authentication.istio.io/v1alpha1"
kind: "MeshPolicy"
metadata:
  name: "default"
  labels:
    release: {{ .Release.Name }}
spec:
  peers:
  - mtls: {}
---
{{- if not .Values.global.mtls.auto }}
# We only need explicit destination rule with ISITO_MUTUAL when auto mTLS is not enabled.
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: "default"
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
spec:
  host: "*.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
{{ end }}
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: "api-server"
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
spec:
  host: "kubernetes.default.svc.{{ .Values.global.proxy.clusterDomain }}"
  trafficPolicy:
    tls:
      mode: DISABLE
---
{{ end }}
{{ end }}
`)

func chartsIstioControlIstioDiscoveryTemplatesEnableMeshMtlsYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplatesEnableMeshMtlsYaml, nil
}

func chartsIstioControlIstioDiscoveryTemplatesEnableMeshMtlsYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplatesEnableMeshMtlsYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/enable-mesh-mtls.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplatesIstiodInjectorConfigmapYaml = []byte(`{{ if or (eq .Values.revision "") (not .Values.clusterResources) }}
{{- if and (not .Values.global.omitSidecarInjectorConfigMap) .Values.global.istiod.enabled }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
data:
{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
  values: |-
{{ pick .Values "global" "istio_cni" "sidecarInjectorWebhook" | toPrettyJson | indent 4 }}

  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
  # and istiod webhook functionality.
  #
  # New fields should not use Values - it is a 'primary' config object, users should be able
  # to fine tune it or use it with kube-inject.
  config: |-
    policy: {{ .Values.global.proxy.autoInject }}
    alwaysInjectSelector:
{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
    neverInjectSelector:
{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
    injectedAnnotations:
      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
      "{{ $key }}": "{{ $val }}"
      {{- end }}

{{ .Files.Get "files/injection-template.yaml" | trim | indent 4 }}

{{- end }}
{{- end }}
`)

func chartsIstioControlIstioDiscoveryTemplatesIstiodInjectorConfigmapYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplatesIstiodInjectorConfigmapYaml, nil
}

func chartsIstioControlIstioDiscoveryTemplatesIstiodInjectorConfigmapYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplatesIstiodInjectorConfigmapYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/istiod-injector-configmap.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplatesMutatingwebhookYaml = []byte(`# Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds)
{{- if .Values.global.istiod.enabled }}
{{- if and (not .Values.global.operatorManageWebhooks) .Values.global.istiod.enabled }}
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
{{- if eq .Release.Namespace "istio-system"}}
  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
{{ else }}
  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
{{- end }}
  labels:
    app: sidecar-injector
    release: {{ .Release.Name }}
webhooks:
  - name: sidecar-injector.istio.io
    clientConfig:
      service:
        name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
        namespace: {{ .Release.Namespace }}
        path: "/inject"
      caBundle: ""
    rules:
      - operations: [ "CREATE" ]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods"]
    failurePolicy: Fail
    namespaceSelector:
{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
      matchExpressions:
      - key: name
        operator: NotIn
        values:
        - {{ .Release.Namespace }}
      - key: istio-injection
        operator: NotIn
        values:
        - disabled
      - key: istio-env
        operator: DoesNotExist
      - key: istio.io/rev
        operator: DoesNotExist
{{- else if .Values.revision }}
      matchExpressions:
      - key: istio-injection
        operator: NotIn
        values:
        - disabled
      - key: istio.io/rev
        operator: In
        values:
        - {{ .Values.revision }}
{{- else if eq .Values.sidecarInjectorWebhook.injectLabel "istio-injection" }}
      matchLabels:
        istio-injection: enabled
{{- else }}
      matchLabels:
        istio-env: {{ .Release.Namespace }}
{{- end }}
{{- if .Values.sidecarInjectorWebhook.objectSelector.enabled }}
    objectSelector:
{{- if .Values.sidecarInjectorWebhook.objectSelector.autoInject }}
      matchExpressions:
      - key: "sidecar.istio.io/inject"
        operator: NotIn
        values:
        - "false"
{{- else }}
      matchLabels:
        "sidecar.istio.io/inject": "true"
{{- end }}
{{- end }}
{{- end }}
{{- end }}`)

func chartsIstioControlIstioDiscoveryTemplatesMutatingwebhookYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplatesMutatingwebhookYaml, nil
}

func chartsIstioControlIstioDiscoveryTemplatesMutatingwebhookYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplatesMutatingwebhookYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/mutatingwebhook.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplatesPoddisruptionbudgetYaml = []byte(`{{ if or (eq .Values.revision "") (not .Values.clusterResources) }}
{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  namespace: {{ .Release.Namespace }}
  labels:
    app: istiod
    release: {{ .Release.Name }}
    istio: pilot
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app: istiod
      {{- if ne .Values.revision ""}}
      version: {{ .Values.revision }}
      {{- end }}
      istio: pilot
---
{{- end }}
{{- end }}
`)

func chartsIstioControlIstioDiscoveryTemplatesPoddisruptionbudgetYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplatesPoddisruptionbudgetYaml, nil
}

func chartsIstioControlIstioDiscoveryTemplatesPoddisruptionbudgetYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplatesPoddisruptionbudgetYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/poddisruptionbudget.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplatesServiceYaml = []byte(`{{ if or (eq .Values.revision "") (not .Values.clusterResources) }}
apiVersion: v1
kind: Service
metadata:
  name: istio-pilot{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  namespace: {{ .Release.Namespace }}
  labels:
    app: pilot
    release: {{ .Release.Name }}
    istio: pilot
spec:
  ports:
  - port: 15010
    name: grpc-xds # direct
  - port: 15011
    name: https-xds # mTLS
  - port: 15012
    name: https-dns # mTLS with k8s-signed cert
  - port: 8080
    name: http-legacy-discovery # direct
  - port: 15014
    name: http-monitoring
{{- if .Values.global.istiod.enabled }}
  - port: 443
    name: https-webhook # validation and injection
    targetPort: 15017
{{- end }}
  selector:
    {{- if ne .Values.revision ""}}
    app: istiod
    version: {{ .Values.revision }}
    {{ else }}
    istio: pilot
    {{- end }}
---
{{- if .Values.global.istiod.enabled }}
apiVersion: v1
kind: Service
metadata:
  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  namespace: {{ .Release.Namespace }}
  labels:
    app: istiod
    release: {{ .Release.Name }}
spec:
  ports:
    - port: 15012
      name: https-dns # mTLS with k8s-signed cert
    - port: 443
      name: https-webhook # validation and injection
      targetPort: 15017
  selector:
    app: istiod
    {{- if ne .Values.revision ""}}
    version: {{ .Values.revision }}
    {{- else }}
    # Label used by the 'default' service. For versioned deployments we match with app and version.
    # This avoids default deployment picking the canary
    istio: pilot
    {{- end }}
{{- end }}
---
{{- end }}
`)

func chartsIstioControlIstioDiscoveryTemplatesServiceYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplatesServiceYaml, nil
}

func chartsIstioControlIstioDiscoveryTemplatesServiceYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplatesServiceYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/service.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplatesServiceaccountYaml = []byte(`{{ if .Values.clusterResources }}
apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end }}
metadata:
  name: istio-pilot-service-account
  namespace: {{ .Release.Namespace }}
  labels:
    app: istiod
    release: {{ .Release.Name }}
---
{{ end }}
`)

func chartsIstioControlIstioDiscoveryTemplatesServiceaccountYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplatesServiceaccountYaml, nil
}

func chartsIstioControlIstioDiscoveryTemplatesServiceaccountYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplatesServiceaccountYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/serviceaccount.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplatesTelemetryv2_14Yaml = []byte(`{{ if or (eq .Values.revision "") (not .Values.clusterResources) }}
{{- if and .Values.telemetry.enabled .Values.telemetry.v2.enabled }}
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: metadata-exchange-1.4
  {{- if .Values.global.configRootNamespace }}
  namespace: {{ .Values.global.configRootNamespace }}
  {{- else }}
  namespace: {{ .Release.Namespace }}
  {{- end }}
spec:
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: ANY # inbound, outbound, and gateway
        proxy:
          proxyVersion: '^1\.4.*'
        listener:
          filterChain:
            filter:
              name: "envoy.http_connection_manager"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.wasm
          config:
            config:
              configuration: envoy.wasm.metadata_exchange
              vm_config:
                runtime: envoy.wasm.runtime.null
                code:
                  inline_string: envoy.wasm.metadata_exchange
---
{{- if .Values.telemetry.v2.prometheus.enabled }}
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: stats-filter-1.4
  {{- if .Values.global.configRootNamespace }}
  namespace: {{ .Values.global.configRootNamespace }}
  {{- else }}
  namespace: {{ .Release.Namespace }}
  {{- end }}
spec:
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_OUTBOUND
        proxy:
          proxyVersion: '^1\.4.*'
        listener:
          filterChain:
            filter:
              name: "envoy.http_connection_manager"
              subFilter:
                name: "envoy.router"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.wasm
          config:
            config:
              root_id: stats_outbound
              configuration: |
                {
                  "debug": "false",
                  "stat_prefix": "istio",
                }
              vm_config:
                vm_id: stats_outbound
                runtime: envoy.wasm.runtime.null
                code:
                  inline_string: envoy.wasm.stats
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND
        proxy:
          proxyVersion: '^1\.4.*'
        listener:
          filterChain:
            filter:
              name: "envoy.http_connection_manager"
              subFilter:
                name: "envoy.router"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.wasm
          config:
            config:
              root_id: stats_inbound
              configuration: |
                {
                  "debug": "false",
                  "stat_prefix": "istio",
                }
              vm_config:
                vm_id: stats_inbound
                runtime: envoy.wasm.runtime.null
                code:
                  inline_string: envoy.wasm.stats
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        proxy:
          proxyVersion: '^1\.4.*'
        listener:
          filterChain:
            filter:
              name: "envoy.http_connection_manager"
              subFilter:
                name: "envoy.router"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.wasm
          config:
            config:
              root_id: stats_outbound
              configuration: |
                {
                  "debug": "false",
                  "stat_prefix": "istio",
                  "disable_host_header_fallback": true,
                }
              vm_config:
                vm_id: stats_outbound
                runtime: envoy.wasm.runtime.null
                code:
                  inline_string: envoy.wasm.stats
---
{{- end }}
{{- if .Values.telemetry.v2.stackdriver.enabled }}
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: stackdriver-filter-1.4
  {{- if .Values.global.configRootNamespace }}
  namespace: {{ .Values.global.configRootNamespace }}
  {{- else }}
  namespace: {{ .Release.Namespace }}
  {{- end }}
spec:
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_OUTBOUND
        proxy:
          proxyVersion: '^1\.4.*'
        listener:
          filterChain:
            filter:
              name: "envoy.http_connection_manager"
              subFilter:
                name: "envoy.router"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.wasm
          config:
            config:
              root_id: stackdriver_outbound
              configuration: |
                {{- if not .Values.telemetry.v2.stackdriver.configOverride }}
                {"enable_mesh_edges_reporting": {{ .Values.telemetry.v2.stackdriver.topology }}, "disable_server_access_logging": {{ not .Values.telemetry.v2.stackdriver.logging }}, "meshEdgesReportingDuration": "600s"}
                {{- else }}
                {{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 8 }}
                {{- end }}
              vm_config:
                vm_id: stackdriver_outbound
                runtime: envoy.wasm.runtime.null
                code:
                  inline_string: envoy.wasm.null.stackdriver
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND
        proxy:
          proxyVersion: '^1\.4.*'
        listener:
          filterChain:
            filter:
              name: "envoy.http_connection_manager"
              subFilter:
                name: "envoy.router"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.wasm
          config:
            config:
              root_id: stackdriver_inbound
              configuration: |
                {{- if not .Values.telemetry.v2.stackdriver.configOverride }}
                {"enable_mesh_edges_reporting": {{ .Values.telemetry.v2.stackdriver.topology }}, "disable_server_access_logging": {{ not .Values.telemetry.v2.stackdriver.logging }}, "meshEdgesReportingDuration": "600s"}
                {{- else }}
                {{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 16 }}
                {{- end }}
              vm_config:
                vm_id: stackdriver_inbound
                runtime: envoy.wasm.runtime.null
                code:
                  inline_string: envoy.wasm.null.stackdriver
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        proxy:
          proxyVersion: '^1\.4.*'
        listener:
          filterChain:
            filter:
              name: "envoy.http_connection_manager"
              subFilter:
                name: "envoy.router"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.wasm
          config:
            config:
              root_id: stackdriver_outbound
              configuration: |
                {{- if not .Values.telemetry.v2.stackdriver.configOverride }}
                {"enable_mesh_edges_reporting": {{ .Values.telemetry.v2.stackdriver.topology }}, "disable_server_access_logging": {{ not .Values.telemetry.v2.stackdriver.logging }}, "meshEdgesReportingDuration": "600s", "disable_host_header_fallback": true}
                {{- else }}
                {{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 16 }}
                {{- end }}
              vm_config:
                vm_id: stackdriver_outbound
                runtime: envoy.wasm.runtime.null
                code:
                  inline_string: envoy.wasm.null.stackdriver
---
{{- end}}
{{- end}}
{{- end }}
`)

func chartsIstioControlIstioDiscoveryTemplatesTelemetryv2_14YamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplatesTelemetryv2_14Yaml, nil
}

func chartsIstioControlIstioDiscoveryTemplatesTelemetryv2_14Yaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplatesTelemetryv2_14YamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/telemetryv2_1.4.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplatesTelemetryv2_15Yaml = []byte(`{{ if or (eq .Values.revision "") (not .Values.clusterResources) }}
{{- if and .Values.telemetry.enabled .Values.telemetry.v2.enabled }}
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: metadata-exchange-1.5
  {{- if .Values.global.configRootNamespace }}
  namespace: {{ .Values.global.configRootNamespace }}
  {{- else }}
  namespace: {{ .Release.Namespace }}
  {{- end }}
spec:
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: ANY # inbound, outbound, and gateway
        proxy:
          proxyVersion: '^1\.5.*'
        listener:
          filterChain:
            filter:
              name: "envoy.http_connection_manager"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.wasm
          typed_config:
            "@type": type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.config.filter.http.wasm.v2.Wasm
            value:
              config:
                configuration: envoy.wasm.metadata_exchange
                vm_config:
                  {{- if .Values.telemetry.v2.metadataExchange.wasmEnabled }}
                  runtime: envoy.wasm.runtime.v8
                  code:
                    local:
                      filename: /etc/istio/extensions/metadata-exchange-filter.wasm
                  {{- else }}
                  runtime: envoy.wasm.runtime.null
                  code:
                    local:
                      inline_string: envoy.wasm.metadata_exchange
                  {{- end }}
---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: tcp-metadata-exchange-1.5
  {{- if .Values.global.configRootNamespace }}
  namespace: {{ .Values.global.configRootNamespace }}
  {{- else }}
  namespace: {{ .Release.Namespace }}
  {{- end }}
spec:
  configPatches:
    - applyTo: NETWORK_FILTER
      match:
        context: SIDECAR_INBOUND
        proxy:
          proxyVersion: '^1\.5.*'
        listener: {}
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.network.metadata_exchange
          config:
            protocol: istio-peer-exchange
    - applyTo: CLUSTER
      match:
        context: SIDECAR_OUTBOUND
        proxy:
          proxyVersion: '^1\.5.*'
        cluster: {}
      patch:
        operation: MERGE
        value:
          filters:
          - name: envoy.filters.network.upstream.metadata_exchange
            typed_config:
              "@type": type.googleapis.com/udpa.type.v1.TypedStruct
              type_url: type.googleapis.com/envoy.tcp.metadataexchange.config.MetadataExchange
              value:
                protocol: istio-peer-exchange
    - applyTo: CLUSTER
      match:
        context: GATEWAY
        proxy:
          proxyVersion: '^1\.5.*'
        cluster: {}
      patch:
        operation: MERGE
        value:
          filters:
          - name: envoy.filters.network.upstream.metadata_exchange
            typed_config:
              "@type": type.googleapis.com/udpa.type.v1.TypedStruct
              type_url: type.googleapis.com/envoy.tcp.metadataexchange.config.MetadataExchange
              value:
                protocol: istio-peer-exchange
---
{{- if .Values.telemetry.v2.prometheus.enabled }}
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: stats-filter-1.5
  {{- if .Values.global.configRootNamespace }}
  namespace: {{ .Values.global.configRootNamespace }}
  {{- else }}
  namespace: {{ .Release.Namespace }}
  {{- end }}
spec:
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_OUTBOUND
        proxy:
          proxyVersion: '^1\.5.*'
        listener:
          filterChain:
            filter:
              name: "envoy.http_connection_manager"
              subFilter:
                name: "envoy.router"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.wasm
          typed_config:
            "@type": type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.config.filter.http.wasm.v2.Wasm
            value:
              config:
                root_id: stats_outbound
                configuration: |
                  {
                    "debug": "false",
                    "stat_prefix": "istio",
                  }
                vm_config:
                  vm_id: stats_outbound
                  {{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
                  runtime: envoy.wasm.runtime.v8
                  code:
                    local:
                      filename: /etc/istio/extensions/stats-filter.wasm
                  {{- else }}
                  runtime: envoy.wasm.runtime.null
                  code:
                    local:
                      inline_string: envoy.wasm.stats
                  {{- end }}
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND
        proxy:
          proxyVersion: '^1\.5.*'
        listener:
          filterChain:
            filter:
              name: "envoy.http_connection_manager"
              subFilter:
                name: "envoy.router"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.wasm
          typed_config:
            "@type": type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.config.filter.http.wasm.v2.Wasm
            value:
              config:
                root_id: stats_inbound
                configuration: |
                  {
                    "debug": "false",
                    "stat_prefix": "istio",
                  }
                vm_config:
                  vm_id: stats_inbound
                  {{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
                  runtime: envoy.wasm.runtime.v8
                  code:
                    local:
                      filename: /etc/istio/extensions/stats-filter.wasm
                  {{- else }}
                  runtime: envoy.wasm.runtime.null
                  code:
                    local:
                      inline_string: envoy.wasm.stats
                  {{- end }}
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        proxy:
          proxyVersion: '^1\.5.*'
        listener:
          filterChain:
            filter:
              name: "envoy.http_connection_manager"
              subFilter:
                name: "envoy.router"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.wasm
          typed_config:
            "@type": type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.config.filter.http.wasm.v2.Wasm
            value:
              config:
                root_id: stats_outbound
                configuration: |
                  {
                    "debug": "false",
                    "stat_prefix": "istio",
                    "disable_host_header_fallback": true,
                  }
                vm_config:
                  vm_id: stats_outbound
                  {{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
                  runtime: envoy.wasm.runtime.v8
                  code:
                    local:
                      filename: /etc/istio/extensions/stats-filter.wasm
                  {{- else }}
                  runtime: envoy.wasm.runtime.null
                  code:
                    local:
                      inline_string: envoy.wasm.stats
                  {{- end }}
---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: tcp-stats-filter-1.5
  {{- if .Values.global.configRootNamespace }}
  namespace: {{ .Values.global.configRootNamespace }}
  {{- else }}
  namespace: {{ .Release.Namespace }}
  {{- end }}
spec:
  configPatches:
    - applyTo: NETWORK_FILTER
      match:
        context: SIDECAR_INBOUND
        proxy:
          proxyVersion: '^1\.5.*'
        listener:
          filterChain:
            filter:
              name: "envoy.tcp_proxy"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.network.wasm
          typed_config:
            "@type": type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.config.filter.network.wasm.v2.Wasm
            value:
              config:
                root_id: stats_inbound
                configuration: |
                  {
                    "debug": "false",
                    "stat_prefix": "istio",
                  }
                vm_config:
                  vm_id: tcp_stats_inbound
                  {{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
                  runtime: envoy.wasm.runtime.v8
                  code:
                    local:
                      filename: /etc/istio/extensions/stats-filter.wasm
                  {{- else }}
                  runtime: envoy.wasm.runtime.null
                  code:
                    local:
                      inline_string: "envoy.wasm.stats"
                  {{- end }}
    - applyTo: NETWORK_FILTER
      match:
        context: SIDECAR_OUTBOUND
        proxy:
          proxyVersion: '^1\.5.*'
        listener:
          filterChain:
            filter:
              name: "envoy.tcp_proxy"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.network.wasm
          typed_config:
            "@type": type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.config.filter.network.wasm.v2.Wasm
            value:
              config:
                root_id: stats_outbound
                configuration: |
                  {
                    "debug": "false",
                    "stat_prefix": "istio",
                  }
                vm_config:
                  vm_id: tcp_stats_outbound
                  {{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
                  runtime: envoy.wasm.runtime.v8
                  code:
                    local:
                      filename: /etc/istio/extensions/stats-filter.wasm
                  {{- else }}
                  runtime: envoy.wasm.runtime.null
                  code:
                    local:
                      inline_string: "envoy.wasm.stats"
                  {{- end }}
    - applyTo: NETWORK_FILTER
      match:
        context: GATEWAY
        proxy:
          proxyVersion: '^1\.5.*'
        listener:
          filterChain:
            filter:
              name: "envoy.tcp_proxy"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.network.wasm
          typed_config:
            "@type": type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.config.filter.network.wasm.v2.Wasm
            value:
              config:
                root_id: stats_outbound
                configuration: |
                  {
                    "debug": "false",
                    "stat_prefix": "istio",
                  }
                vm_config:
                  vm_id: tcp_stats_outbound
                  {{- if .Values.telemetry.v2.prometheus.wasmEnabled }}
                  runtime: envoy.wasm.runtime.v8
                  code:
                    local:
                      filename: /etc/istio/extensions/stats-filter.wasm
                  {{- else }}
                  runtime: envoy.wasm.runtime.null
                  code:
                    local:
                      inline_string: "envoy.wasm.stats"
                  {{- end }}
---
{{- end }}

{{- if .Values.telemetry.v2.stackdriver.enabled }}
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: stackdriver-filter-1.5
  {{- if .Values.global.configRootNamespace }}
  namespace: {{ .Values.global.configRootNamespace }}
  {{- else }}
  namespace: {{ .Release.Namespace }}
  {{- end }}
spec:
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_OUTBOUND
        proxy:
          proxyVersion: '^1\.5.*'
        listener:
          filterChain:
            filter:
              name: "envoy.http_connection_manager"
              subFilter:
                name: "envoy.router"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.wasm
          typed_config:
            "@type": type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.config.filter.http.wasm.v2.Wasm
            value:
              config:
                root_id: stackdriver_outbound
                configuration: |
                  {{- if not .Values.telemetry.v2.stackdriver.configOverride }}
                  {"enable_mesh_edges_reporting": {{ .Values.telemetry.v2.stackdriver.topology }}, "disable_server_access_logging": {{ not .Values.telemetry.v2.stackdriver.logging }}, "meshEdgesReportingDuration": "600s"}
                  {{- else }}
                  {{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
                  {{- end }}
                vm_config:
                  vm_id: stackdriver_outbound
                  runtime: envoy.wasm.runtime.null
                  code:
                    local: { inline_string: envoy.wasm.null.stackdriver }
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND
        proxy:
          proxyVersion: '^1\.5.*'
        listener:
          filterChain:
            filter:
              name: "envoy.http_connection_manager"
              subFilter:
                name: "envoy.router"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.wasm
          typed_config:
            "@type": type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.config.filter.http.wasm.v2.Wasm
            value:
              config:
                root_id: stackdriver_inbound
                configuration: |
                  {{- if not .Values.telemetry.v2.stackdriver.configOverride }}
                  {"enable_mesh_edges_reporting": {{ .Values.telemetry.v2.stackdriver.topology }}, "disable_server_access_logging": {{ not .Values.telemetry.v2.stackdriver.logging }}, "meshEdgesReportingDuration": "600s"}
                  {{- else }}
                  {{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
                  {{- end }}
                vm_config:
                  vm_id: stackdriver_inbound
                  runtime: envoy.wasm.runtime.null
                  code:
                    local: { inline_string: envoy.wasm.null.stackdriver }
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        proxy:
          proxyVersion: '^1\.5.*'
        listener:
          filterChain:
            filter:
              name: "envoy.http_connection_manager"
              subFilter:
                name: "envoy.router"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.wasm
          typed_config:
            "@type": type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.config.filter.http.wasm.v2.Wasm
            value:
              config:
                root_id: stackdriver_outbound
                configuration: |
                  {{- if not .Values.telemetry.v2.stackdriver.configOverride }}
                  {"enable_mesh_edges_reporting": {{ .Values.telemetry.v2.stackdriver.topology }}, "disable_server_access_logging": {{ not .Values.telemetry.v2.stackdriver.logging }}, "meshEdgesReportingDuration": "600s", "disable_host_header_fallback": true}
                  {{- else }}
                  {{ toJson .Values.telemetry.v2.stackdriver.configOverride | indent 18 }}
                  {{- end }}
                vm_config:
                  vm_id: stackdriver_outbound
                  runtime: envoy.wasm.runtime.null
                  code:
                    local: { inline_string: envoy.wasm.null.stackdriver }
---
{{- end}}
{{- end}}
{{- end }}
`)

func chartsIstioControlIstioDiscoveryTemplatesTelemetryv2_15YamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplatesTelemetryv2_15Yaml, nil
}

func chartsIstioControlIstioDiscoveryTemplatesTelemetryv2_15Yaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplatesTelemetryv2_15YamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/telemetryv2_1.5.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryTemplatesValidatingwebhookconfigurationYaml = []byte(`{{- if .Values.clusterResources }}
{{- if .Values.global.istiod.enabled }}
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: istiod-{{ .Release.Namespace }}
  labels:
    app: istiod
    release: {{ .Release.Name }}
    istio: istiod
webhooks:
  - name: validation.istio.io
    clientConfig:
      service:
        name: istiod
        namespace: {{ .Release.Namespace }}
        path: "/validate"
      caBundle: "" # patched at runtime when the webhook is ready.
    rules:
      - operations:
        - CREATE
        - UPDATE
        apiGroups:
        - config.istio.io
        - rbac.istio.io
        - security.istio.io
        - authentication.istio.io
        - networking.istio.io
        apiVersions:
        - "*"
        resources:
        - "*"
    # Fail open until the validation webhook is ready. The webhook controller
    # will update this to `+"`"+`Fail`+"`"+` and patch in the `+"`"+`caBundle`+"`"+` when the webhook
    # endpoint is ready.
    failurePolicy: Ignore
    sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: istio-galley
  labels:
    app: galley
    release: {{ .Release.Name }}
    istio: galley
webhooks:
---
{{- else }}
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: istiod-{{ .Release.Namespace }}
  labels:
    app: istiod
    release: {{ .Release.Name }}
    istio: istiod
webhooks:
{{- end }}
{{- end }}
`)

func chartsIstioControlIstioDiscoveryTemplatesValidatingwebhookconfigurationYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryTemplatesValidatingwebhookconfigurationYaml, nil
}

func chartsIstioControlIstioDiscoveryTemplatesValidatingwebhookconfigurationYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryTemplatesValidatingwebhookconfigurationYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/templates/validatingwebhookconfiguration.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioControlIstioDiscoveryValuesYaml = []byte(`#.Values.pilot for discovery and mesh wide config

## Discovery Settings
pilot:
  autoscaleEnabled: true
  autoscaleMin: 1
  autoscaleMax: 5
  replicaCount: 1
  rollingMaxSurge: 100%
  rollingMaxUnavailable: 25%

  hub: ""
  tag: ""

  # Can be a full hub/image:tag
  image: pilot
  traceSampling: 1.0

  # Resources for a small pilot install
  resources:
    requests:
      cpu: 500m
      memory: 2048Mi

  # Namespace for Istio config
  configNamespace: istio-config

  # Applications namespace list pilot manages
  appNamespaces: []

  env: {}

  cpu:
    targetAverageUtilization: 80

  # if protocol sniffing is enabled for outbound
  enableProtocolSniffingForOutbound: true
  # if protocol sniffing is enabled for inbound
  enableProtocolSniffingForInbound: false

  nodeSelector: {}
  tolerations: []
  podAnnotations: {}

  # You can use jwksResolverExtraRootCA to provide a root certificate
  # in PEM format. This will then be trusted by pilot when resolving
  # JWKS URIs.
  jwksResolverExtraRootCA: ""

  # This is used to set the source of configuration for
  # the associated address in configSource, if nothing is specificed
  # the default MCP is assumed. The alternative option is SERVICE_REGISTRY
  # which describes the source is only forwarding synthetic service entries
  configSource:
    subscribedResources: []

  plugins: []

  # Specify the pod anti-affinity that allows you to constrain which nodes
  # your pod is eligible to be scheduled based on labels on pods that are
  # already running on the node rather than based on labels on nodes.
  # There are currently two types of anti-affinity:
  #    "requiredDuringSchedulingIgnoredDuringExecution"
  #    "preferredDuringSchedulingIgnoredDuringExecution"
  # which denote "hard" vs. "soft" requirements, you can define your values
  # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
  # correspondingly.
  # For example:
  # podAntiAffinityLabelSelector:
  # - key: security
  #   operator: In
  #   values: S1,S2
  #   topologyKey: "kubernetes.io/hostname"
  # This pod anti-affinity rule says that the pod requires not to be scheduled
  # onto a node if that node is already running a pod with label having key
  # "security" and value "S1".
  podAntiAffinityLabelSelector: []
  podAntiAffinityTermLabelSelector: []

  # The following is used to limit how long a sidecar can be connected
  # to a pilot. It balances out load across pilot instances at the cost of
  # increasing system churn.
  keepaliveMaxServerConnectionAge: 30m

  # Additional labels to apply to the deployment.
  deploymentLabels: {}


  ## Mesh config settings

  # Install the mesh config map, generated from values.yaml.
  # If false, pilot wil use default values (by default) or user-supplied values.
  configMap: true

  # Controls legacy k8s ingress
  # Only one pilot profile should enable ingress support !!!
  ingress:
    # If empty, node-port is assumed.
    ingressService: istio-ingressgateway
    # DEFAULT: all Ingress resources without annotation or with istio annotation
    # STRICT: only with istio annotation
    # OFF: no ingress or sync.
    ingressControllerMode: "STRICT"

    # Value to set on "kubernetes.io/ingress.class" annotations to activate, if mode is STRICT
    # This is required to be different than 'istio' if multiple ingresses are present.
    ingressClass: istio

  policy:
    # Will not define mixerCheckServer and mixerReportServer
    enabled: false

## Mixer settings
mixer:
  telemetry:
    # Set reportBatchMaxEntries to 0 to use the default batching behavior (i.e., every 100 requests).
    # A positive value indicates the number of requests that are batched before telemetry data
    # is sent to the mixer server
    reportBatchMaxEntries: 100

    # Set reportBatchMaxTime to 0 to use the default batching behavior (i.e., every 1 second).
    # A positive time value indicates the maximum wait time since the last request will telemetry data
    # be batched before being sent to the mixer server
    reportBatchMaxTime: 1s

    sessionAffinityEnabled: false
  policy:
    enabled: false

sidecarInjectorWebhook:
  # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
  # always skip the injection on pods that match that label selector, regardless of the global policy.
  # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
  neverInjectSelector: []
  alwaysInjectSelector: []

  # injectedAnnotations are additional annotations that will be added to the pod spec after injection
  # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
  #
  # annotations:
  #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
  #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
  #
  # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
  # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
  # injectedAnnotations:
  #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
  #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
  injectedAnnotations: {}

  # This enables injection of sidecar in all namespaces,
  # with the exception of namespaces with "istio-injection:disabled" annotation
  # Only one environment should have this enabled.
  enableNamespacesByDefault: false

  # If set, will use the value as injection label. The value must match the 'release' label of the injector,
  # except when 1.2 istio-injection label is used, which must be set to "enabled".
  injectLabel: istio-injection

  # Enable objectSelector to filter out pods with no need for sidecar before calling istio-sidecar-injector.
  # It is disabled by default since this function will only work after k8s v1.15.
  objectSelector:
    enabled: false
    autoInject: true

galley:
  enabled: false

telemetry:
  enabled: true
  v1:
    # Set true to enable Mixer based telemetry
    enabled: false
  v2:
    # For Null VM case now. If enabled, will set disableMixerHttpReports to true and not define mixerReportServer
    # This also enables metadata exchange.
    enabled: true
    metadataExchange:
      # Indicates whether to enable WebAssembly runtime for metadata exchange filter.
      wasmEnabled: false
    # Indicate if prometheus stats filter is enabled or not
    prometheus:
      enabled: true
      # Indicates whether to enable WebAssembly runtime for stats filter.
      wasmEnabled: false
    # stackdriver filter settings.
    stackdriver:
      enabled: false
      logging: false
      monitoring: false
      topology: false
      #  configOverride parts give you the ability to override the low level configuration params passed to envoy filter.

      configOverride: {}
      #  e.g.
      #  enable_mesh_edges_reporting: true
      #  disable_server_access_logging: false
      #  meshEdgesReportingDuration: 500s
      #  disable_host_header_fallback: true

# Revision is set as 'version' label and part of the resource names when installing multiple control planes.
revision: ""
`)

func chartsIstioControlIstioDiscoveryValuesYamlBytes() ([]byte, error) {
	return _chartsIstioControlIstioDiscoveryValuesYaml, nil
}

func chartsIstioControlIstioDiscoveryValuesYaml() (*asset, error) {
	bytes, err := chartsIstioControlIstioDiscoveryValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-control/istio-discovery/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioOperatorChartYaml = []byte(`apiVersion: v1
name: istio-operator
version: 1.5
tillerVersion: ">=2.7.2"
description: Helm chart for deploying Istio operator
keywords:
  - istio
  - operator
sources:
  - http://github.com/istio/istio/operator
engine: gotpl
icon: https://istio.io/favicons/android-192x192.png
`)

func chartsIstioOperatorChartYamlBytes() ([]byte, error) {
	return _chartsIstioOperatorChartYaml, nil
}

func chartsIstioOperatorChartYaml() (*asset, error) {
	bytes, err := chartsIstioOperatorChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-operator/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioOperatorTemplatesClusterroleYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: null
  name: istio-operator
rules:
# istio groups
- apiGroups:
  - authentication.istio.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - config.istio.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - install.istio.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - networking.istio.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - rbac.istio.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - security.istio.io
  resources:
  - '*'
  verbs:
  - '*'
# k8s groups
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - mutatingwebhookconfigurations
  - validatingwebhookconfigurations
  verbs:
  - '*'
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions.apiextensions.k8s.io
  - customresourcedefinitions
  verbs:
  - '*'
- apiGroups:
  - apps
  - extensions
  resources:
  - daemonsets
  - deployments
  - deployments/finalizers
  - ingresses
  - replicasets
  - statefulsets
  verbs:
  - '*'
- apiGroups:
  - autoscaling
  resources:
  - horizontalpodautoscalers
  verbs:
  - '*'
- apiGroups:
  - monitoring.coreos.com
  resources:
  - servicemonitors
  verbs:
  - get
  - create
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  verbs:
  - '*'
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterrolebindings
  - clusterroles
  - roles
  - rolebindings
  verbs:
  - '*'
- apiGroups:
  - ""
  resources:
  - configmaps
  - endpoints
  - events
  - namespaces
  - pods
  - persistentvolumeclaims
  - secrets
  - services
  - serviceaccounts
  verbs:
  - '*'
---
`)

func chartsIstioOperatorTemplatesClusterroleYamlBytes() ([]byte, error) {
	return _chartsIstioOperatorTemplatesClusterroleYaml, nil
}

func chartsIstioOperatorTemplatesClusterroleYaml() (*asset, error) {
	bytes, err := chartsIstioOperatorTemplatesClusterroleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-operator/templates/clusterrole.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioOperatorTemplatesClusterrole_bindingYaml = []byte(`kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: istio-operator
subjects:
- kind: ServiceAccount
  name: istio-operator
  namespace: {{.Values.operatorNamespace}}
roleRef:
  kind: ClusterRole
  name: istio-operator
  apiGroup: rbac.authorization.k8s.io
---
`)

func chartsIstioOperatorTemplatesClusterrole_bindingYamlBytes() ([]byte, error) {
	return _chartsIstioOperatorTemplatesClusterrole_bindingYaml, nil
}

func chartsIstioOperatorTemplatesClusterrole_bindingYaml() (*asset, error) {
	bytes, err := chartsIstioOperatorTemplatesClusterrole_bindingYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-operator/templates/clusterrole_binding.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioOperatorTemplatesCrdYaml = []byte(`apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: istiooperators.install.istio.io
spec:
  group: install.istio.io
  names:
    kind: IstioOperator
    plural: istiooperators
    singular: istiooperator
    shortNames:
    - iop
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        apiVersion:
          description: 'APIVersion defines the versioned schema of this representation
            of an object. Servers should convert recognized schemas to the latest
            internal value, and may reject unrecognized values.
            More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#resources'
          type: string
        kind:
          description: 'Kind is a string value representing the REST resource this
            object represents. Servers may infer this from the endpoint the client
            submits requests to. Cannot be updated. In CamelCase.
            More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
          type: string
        spec:
          description: 'Specification of the desired state of the istio control plane resource.
            More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status'
          type: object
        status:
          description: 'Status describes each of istio control plane component status at the current time.
            0 means NONE, 1 means UPDATING, 2 means HEALTHY, 3 means ERROR, 4 means RECONCILING.
            More info: https://github.com/istio/api/blob/master/operator/v1alpha1/istio.operator.v1alpha1.pb.html &
            https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status'
          type: object
  versions:
  - name: v1alpha1
    served: true
    storage: true
---
`)

func chartsIstioOperatorTemplatesCrdYamlBytes() ([]byte, error) {
	return _chartsIstioOperatorTemplatesCrdYaml, nil
}

func chartsIstioOperatorTemplatesCrdYaml() (*asset, error) {
	bytes, err := chartsIstioOperatorTemplatesCrdYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-operator/templates/crd.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioOperatorTemplatesDeploymentYaml = []byte(`apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: {{.Values.operatorNamespace}}
  name: istio-operator
spec:
  replicas: 1
  selector:
    matchLabels:
      name: istio-operator
  template:
    metadata:
      labels:
        name: istio-operator
    spec:
      serviceAccountName: istio-operator
      containers:
        - name: istio-operator
          image: {{.Values.hub}}/operator:{{.Values.tag}}
          command:
          - operator
          - server
          imagePullPolicy: IfNotPresent
          resources:
            limits:
              cpu: 200m
              memory: 256Mi
            requests:
              cpu: 50m
              memory: 128Mi
          env:
            - name: WATCH_NAMESPACE
              value: {{.Values.istioNamespace}}
            - name: LEADER_ELECTION_NAMESPACE
              value: {{.Values.operatorNamespace}}
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPERATOR_NAME
              value: {{.Values.operatorNamespace}}
---
`)

func chartsIstioOperatorTemplatesDeploymentYamlBytes() ([]byte, error) {
	return _chartsIstioOperatorTemplatesDeploymentYaml, nil
}

func chartsIstioOperatorTemplatesDeploymentYaml() (*asset, error) {
	bytes, err := chartsIstioOperatorTemplatesDeploymentYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-operator/templates/deployment.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioOperatorTemplatesNamespaceYaml = []byte(`apiVersion: v1
kind: Namespace
metadata:
  name: {{.Values.operatorNamespace}}
  labels:
    istio-operator-managed: Reconcile
    istio-injection: disabled
---
`)

func chartsIstioOperatorTemplatesNamespaceYamlBytes() ([]byte, error) {
	return _chartsIstioOperatorTemplatesNamespaceYaml, nil
}

func chartsIstioOperatorTemplatesNamespaceYaml() (*asset, error) {
	bytes, err := chartsIstioOperatorTemplatesNamespaceYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-operator/templates/namespace.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioOperatorTemplatesServiceYaml = []byte(`apiVersion: v1
kind: Service
metadata:
  namespace: {{.Values.operatorNamespace}}
  labels:
    name: istio-operator
  name: istio-operator
spec:
  ports:
  - name: http-metrics
    port: 8383
    targetPort: 8383
  selector:
    name: istio-operator
---
`)

func chartsIstioOperatorTemplatesServiceYamlBytes() ([]byte, error) {
	return _chartsIstioOperatorTemplatesServiceYaml, nil
}

func chartsIstioOperatorTemplatesServiceYaml() (*asset, error) {
	bytes, err := chartsIstioOperatorTemplatesServiceYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-operator/templates/service.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioOperatorTemplatesService_accountYaml = []byte(`apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: {{.Values.operatorNamespace}}
  name: istio-operator
---
`)

func chartsIstioOperatorTemplatesService_accountYamlBytes() ([]byte, error) {
	return _chartsIstioOperatorTemplatesService_accountYaml, nil
}

func chartsIstioOperatorTemplatesService_accountYaml() (*asset, error) {
	bytes, err := chartsIstioOperatorTemplatesService_accountYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-operator/templates/service_account.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioOperatorValuesYaml = []byte(`hub: gcr.io/istio-testing
tag: 1.5-dev
operatorNamespace: istio-operator
istioNamespace: istio-system
`)

func chartsIstioOperatorValuesYamlBytes() ([]byte, error) {
	return _chartsIstioOperatorValuesYaml, nil
}

func chartsIstioOperatorValuesYaml() (*asset, error) {
	bytes, err := chartsIstioOperatorValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-operator/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioPolicyChartYaml = []byte(`apiVersion: v1
name: istio-policy
version: 1.1.0
appVersion: 1.1.0
tillerVersion: ">=2.7.2"
description: Helm chart for mixer policy deployment
keywords:
  - istio
  - mixer
sources:
  - http://github.com/istio/istio
engine: gotpl
icon: https://istio.io/favicons/android-192x192.png
`)

func chartsIstioPolicyChartYamlBytes() ([]byte, error) {
	return _chartsIstioPolicyChartYaml, nil
}

func chartsIstioPolicyChartYaml() (*asset, error) {
	bytes, err := chartsIstioPolicyChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-policy/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioPolicyTemplates_affinityTpl = []byte(`{{/* affinity - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ */}}

{{- define "nodeaffinity" }}
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityRequiredDuringScheduling" . }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityPreferredDuringScheduling" . }}
{{- end }}

{{- define "nodeAffinityRequiredDuringScheduling" }}
      nodeSelectorTerms:
      - matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
        {{- range $key, $val := .Values.global.arch }}
          {{- if gt ($val | int) 0 }}
          - {{ $key | quote }}
          {{- end }}
        {{- end }}
        {{- $nodeSelector := default .Values.global.defaultNodeSelector .Values.mixer.policy.nodeSelector -}}
        {{- range $key, $val := $nodeSelector }}
        - key: {{ $key }}
          operator: In
          values:
          - {{ $val | quote }}
        {{- end }}
{{- end }}

{{- define "nodeAffinityPreferredDuringScheduling" }}
  {{- range $key, $val := .Values.global.arch }}
    {{- if gt ($val | int) 0 }}
    - weight: {{ $val | int }}
      preference:
        matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
          - {{ $key | quote }}
    {{- end }}
  {{- end }}
{{- end }}

{{- define "podAntiAffinity" }}
{{- if or .Values.mixer.policy.podAntiAffinityLabelSelector .Values.mixer.policy.podAntiAffinityTermLabelSelector}}
  podAntiAffinity:
    {{- if .Values.mixer.policy.podAntiAffinityLabelSelector }}
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityRequiredDuringScheduling" . }}
    {{- end }}
    {{- if .Values.mixer.policy.podAntiAffinityTermLabelSelector }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityPreferredDuringScheduling" . }}
    {{- end }}
{{- end }}
{{- end }}

{{- define "podAntiAffinityRequiredDuringScheduling" }}
    {{- range $index, $item := .Values.mixer.policy.podAntiAffinityLabelSelector }}
    - labelSelector:
        matchExpressions:
        - key: {{ $item.key }}
          operator: {{ $item.operator }}
          {{- if $item.values }}
          values:
          {{- $vals := split "," $item.values }}
          {{- range $i, $v := $vals }}
          - {{ $v | quote }}
          {{- end }}
          {{- end }}
      topologyKey: {{ $item.topologyKey }}
    {{- end }}
{{- end }}

{{- define "podAntiAffinityPreferredDuringScheduling" }}
    {{- range $index, $item := .Values.mixer.policy.podAntiAffinityTermLabelSelector }}
    - podAffinityTerm:
        labelSelector:
          matchExpressions:
          - key: {{ $item.key }}
            operator: {{ $item.operator }}
            {{- if $item.values }}
            values:
            {{- $vals := split "," $item.values }}
            {{- range $i, $v := $vals }}
            - {{ $v | quote }}
            {{- end }}
            {{- end }}
        topologyKey: {{ $item.topologyKey }}
      weight: 100
    {{- end }}
{{- end }}
`)

func chartsIstioPolicyTemplates_affinityTplBytes() ([]byte, error) {
	return _chartsIstioPolicyTemplates_affinityTpl, nil
}

func chartsIstioPolicyTemplates_affinityTpl() (*asset, error) {
	bytes, err := chartsIstioPolicyTemplates_affinityTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-policy/templates/_affinity.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioPolicyTemplates_helpersTpl = []byte(`{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "mixer.name" -}}
{{- default .Chart.Name .Values.mixer.policy.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "mixer.fullname" -}}
{{- if .Values.mixer.policy.fullnameOverride -}}
{{- .Values.mixer.policy.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.mixer.policy.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "mixer.chart" -}}
{{- .Chart.Name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
`)

func chartsIstioPolicyTemplates_helpersTplBytes() ([]byte, error) {
	return _chartsIstioPolicyTemplates_helpersTpl, nil
}

func chartsIstioPolicyTemplates_helpersTpl() (*asset, error) {
	bytes, err := chartsIstioPolicyTemplates_helpersTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-policy/templates/_helpers.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioPolicyTemplatesAutoscaleYaml = []byte(`{{- if and .Values.mixer.policy.autoscaleEnabled .Values.mixer.policy.autoscaleMin .Values.mixer.policy.autoscaleMax }}
apiVersion: autoscaling/v2beta1
kind: HorizontalPodAutoscaler
metadata:
  name: istio-policy
  namespace: {{ .Release.Namespace }}
  labels:
    app: mixer
    release: {{ .Release.Name }}
spec:
    maxReplicas: {{ .Values.mixer.policy.autoscaleMax }}
    minReplicas: {{ .Values.mixer.policy.autoscaleMin }}
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: istio-policy
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageUtilization: {{ .Values.mixer.policy.cpu.targetAverageUtilization }}
---
{{- end }}
`)

func chartsIstioPolicyTemplatesAutoscaleYamlBytes() ([]byte, error) {
	return _chartsIstioPolicyTemplatesAutoscaleYaml, nil
}

func chartsIstioPolicyTemplatesAutoscaleYaml() (*asset, error) {
	bytes, err := chartsIstioPolicyTemplatesAutoscaleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-policy/templates/autoscale.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioPolicyTemplatesClusterroleYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-policy
  labels:
    release: {{ .Release.Name }}
    app: istio-policy
rules:
- apiGroups: ["config.istio.io"] # istio CRD watcher
  resources: ["*"]
  verbs: ["create", "get", "list", "watch", "patch"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["configmaps", "endpoints", "pods", "services", "namespaces", "secrets", "replicationcontrollers"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["extensions", "apps"]
  resources: ["replicasets"]
  verbs: ["get", "list", "watch"]
---
`)

func chartsIstioPolicyTemplatesClusterroleYamlBytes() ([]byte, error) {
	return _chartsIstioPolicyTemplatesClusterroleYaml, nil
}

func chartsIstioPolicyTemplatesClusterroleYaml() (*asset, error) {
	bytes, err := chartsIstioPolicyTemplatesClusterroleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-policy/templates/clusterrole.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioPolicyTemplatesClusterrolebindingYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-policy-admin-role-binding-{{ .Release.Namespace }}
  labels:
    app: istio-policy
    release: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istio-policy
subjects:
  - kind: ServiceAccount
    name: istio-policy-service-account
    namespace: {{ .Release.Namespace }}
---
`)

func chartsIstioPolicyTemplatesClusterrolebindingYamlBytes() ([]byte, error) {
	return _chartsIstioPolicyTemplatesClusterrolebindingYaml, nil
}

func chartsIstioPolicyTemplatesClusterrolebindingYaml() (*asset, error) {
	bytes, err := chartsIstioPolicyTemplatesClusterrolebindingYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-policy/templates/clusterrolebinding.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioPolicyTemplatesConfigYaml = []byte(`{{ if not (eq .Release.Namespace "istio-system") }}
apiVersion: "config.istio.io/v1alpha2"
kind: attributemanifest
metadata:
  name: istioproxy
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-policy
    release: {{ .Release.Name }}
spec:
  attributes:
    origin.ip:
      valueType: IP_ADDRESS
    origin.uid:
      valueType: STRING
    origin.user:
      valueType: STRING
    request.headers:
      valueType: STRING_MAP
    request.id:
      valueType: STRING
    request.host:
      valueType: STRING
    request.method:
      valueType: STRING
    request.path:
      valueType: STRING
    request.url_path:
      valueType: STRING
    request.query_params:
      valueType: STRING_MAP
    request.reason:
      valueType: STRING
    request.referer:
      valueType: STRING
    request.scheme:
      valueType: STRING
    request.total_size:
      valueType: INT64
    request.size:
      valueType: INT64
    request.time:
      valueType: TIMESTAMP
    request.useragent:
      valueType: STRING
    response.code:
      valueType: INT64
    response.duration:
      valueType: DURATION
    response.headers:
      valueType: STRING_MAP
    response.total_size:
      valueType: INT64
    response.size:
      valueType: INT64
    response.time:
      valueType: TIMESTAMP
    response.grpc_status:
      valueType: STRING
    response.grpc_message:
      valueType: STRING
    source.uid:
      valueType: STRING
    source.user: # DEPRECATED
      valueType: STRING
    source.principal:
      valueType: STRING
    destination.uid:
      valueType: STRING
    destination.principal:
      valueType: STRING
    destination.port:
      valueType: INT64
    connection.event:
      valueType: STRING
    connection.id:
      valueType: STRING
    connection.received.bytes:
      valueType: INT64
    connection.received.bytes_total:
      valueType: INT64
    connection.sent.bytes:
      valueType: INT64
    connection.sent.bytes_total:
      valueType: INT64
    connection.duration:
      valueType: DURATION
    connection.mtls:
      valueType: BOOL
    connection.requested_server_name:
      valueType: STRING
    context.protocol:
      valueType: STRING
    context.proxy_error_code:
      valueType: STRING
    context.timestamp:
      valueType: TIMESTAMP
    context.time:
      valueType: TIMESTAMP
    # Deprecated, kept for compatibility
    context.reporter.local:
      valueType: BOOL
    context.reporter.kind:
      valueType: STRING
    context.reporter.uid:
      valueType: STRING
    context.proxy_version:
      valueType: STRING
    api.service:
      valueType: STRING
    api.version:
      valueType: STRING
    api.operation:
      valueType: STRING
    api.protocol:
      valueType: STRING
    request.auth.principal:
      valueType: STRING
    request.auth.audiences:
      valueType: STRING
    request.auth.presenter:
      valueType: STRING
    request.auth.claims:
      valueType: STRING_MAP
    request.auth.raw_claims:
      valueType: STRING
    request.api_key:
      valueType: STRING
    rbac.permissive.response_code:
      valueType: STRING
    rbac.permissive.effective_policy_id:
      valueType: STRING
    check.error_code:
      valueType: INT64
    check.error_message:
      valueType: STRING
    check.cache_hit:
      valueType: BOOL
    quota.cache_hit:
      valueType: BOOL

---
apiVersion: "config.istio.io/v1alpha2"
kind: attributemanifest
metadata:
  name: kubernetes
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-policy
    release: {{ .Release.Name }}
spec:
  attributes:
    source.ip:
      valueType: IP_ADDRESS
    source.labels:
      valueType: STRING_MAP
    source.metadata:
      valueType: STRING_MAP
    source.name:
      valueType: STRING
    source.namespace:
      valueType: STRING
    source.owner:
      valueType: STRING
    source.serviceAccount:
      valueType: STRING
    source.services:
      valueType: STRING
    source.workload.uid:
      valueType: STRING
    source.workload.name:
      valueType: STRING
    source.workload.namespace:
      valueType: STRING
    destination.ip:
      valueType: IP_ADDRESS
    destination.labels:
      valueType: STRING_MAP
    destination.metadata:
      valueType: STRING_MAP
    destination.owner:
      valueType: STRING
    destination.name:
      valueType: STRING
    destination.container.name:
      valueType: STRING
    destination.namespace:
      valueType: STRING
    destination.service.uid:
      valueType: STRING
    destination.service.name:
      valueType: STRING
    destination.service.namespace:
      valueType: STRING
    destination.service.host:
      valueType: STRING
    destination.serviceAccount:
      valueType: STRING
    destination.workload.uid:
      valueType: STRING
    destination.workload.name:
      valueType: STRING
    destination.workload.namespace:
      valueType: STRING
---
{{- if .Values.mixer.policy.adapters.kubernetesenv.enabled }}
apiVersion: "config.istio.io/v1alpha2"
kind: handler
metadata:
  name: kubernetesenv
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-policy
    release: {{ .Release.Name }}
spec:
  compiledAdapter: kubernetesenv
  params:
    # when running from mixer root, use the following config after adding a
    # symbolic link to a kubernetes config file via:
    #
    # $ ln -s ~/.kube/config mixer/adapter/kubernetes/kubeconfig
    #
    # kubeconfig_path: "mixer/adapter/kubernetes/kubeconfig"

---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: kubeattrgenrulerule
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-policy
    release: {{ .Release.Name }}
spec:
  actions:
  - handler: kubernetesenv
    instances:
    - attributes
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: tcpkubeattrgenrulerule
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-policy
    release: {{ .Release.Name }}
spec:
  match: context.protocol == "tcp"
  actions:
  - handler: kubernetesenv
    instances:
    - attributes
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: attributes
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-policy
    release: {{ .Release.Name }}
spec:
  compiledTemplate: kubernetes
  params:
    # Pass the required attribute data to the adapter
    source_uid: source.uid | ""
    source_ip: source.ip | ip("0.0.0.0") # default to unspecified ip addr
    destination_uid: destination.uid | ""
    destination_port: destination.port | 0
  attributeBindings:
    # Fill the new attributes from the adapter produced output.
    # $out refers to an instance of OutputTemplate message
    source.ip: $out.source_pod_ip | ip("0.0.0.0")
    source.uid: $out.source_pod_uid | "unknown"
    source.labels: $out.source_labels | emptyStringMap()
    source.name: $out.source_pod_name | "unknown"
    source.namespace: $out.source_namespace | "default"
    source.owner: $out.source_owner | "unknown"
    source.serviceAccount: $out.source_service_account_name | "unknown"
    source.workload.uid: $out.source_workload_uid | "unknown"
    source.workload.name: $out.source_workload_name | "unknown"
    source.workload.namespace: $out.source_workload_namespace | "unknown"
    destination.ip: $out.destination_pod_ip | ip("0.0.0.0")
    destination.uid: $out.destination_pod_uid | "unknown"
    destination.labels: $out.destination_labels | emptyStringMap()
    destination.name: $out.destination_pod_name | "unknown"
    destination.container.name: $out.destination_container_name | "unknown"
    destination.namespace: $out.destination_namespace | "default"
    destination.owner: $out.destination_owner | "unknown"
    destination.serviceAccount: $out.destination_service_account_name | "unknown"
    destination.workload.uid: $out.destination_workload_uid | "unknown"
    destination.workload.name: $out.destination_workload_name | "unknown"
    destination.workload.namespace: $out.destination_workload_namespace | "unknown"
{{- end }}
{{- end }}

---
# Configuration needed by Mixer.
# Mixer cluster is delivered via CDS
# Specify mixer cluster settings
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: istio-policy
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-policy
    release: {{ .Release.Name }}
spec:
  host: istio-policy.{{ .Release.Namespace }}.svc.{{ .Values.global.proxy.clusterDomain }}
  {{- if .Values.global.defaultConfigVisibilitySettings }}
  exportTo:
  - '*'
  {{- end }}
  trafficPolicy:
    portLevelSettings:
    - port:
        number: 15004 # grpc-mixer-mtls
      tls:
        mode: ISTIO_MUTUAL
    - port:
        number: 9091 # grpc-mixer
      tls:
        mode: DISABLE
    connectionPool:
      http:
        http2MaxRequests: 10000
        maxRequestsPerConnection: 10000
---
`)

func chartsIstioPolicyTemplatesConfigYamlBytes() ([]byte, error) {
	return _chartsIstioPolicyTemplatesConfigYaml, nil
}

func chartsIstioPolicyTemplatesConfigYaml() (*asset, error) {
	bytes, err := chartsIstioPolicyTemplatesConfigYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-policy/templates/config.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioPolicyTemplatesDeploymentYaml = []byte(`apiVersion: apps/v1
kind: Deployment
metadata:
  name: istio-policy
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-policy
    istio: mixer
    release: {{ .Release.Name }}
spec:
{{- if not .Values.mixer.policy.autoscaleEnabled }}
{{- if .Values.mixer.policy.replicaCount }}
  replicas: {{ .Values.mixer.policy.replicaCount }}
{{- end }}
{{- end }}
  strategy:
    rollingUpdate:
      maxSurge: {{ .Values.mixer.policy.rollingMaxSurge }}
      maxUnavailable: {{ .Values.mixer.policy.rollingMaxUnavailable }}
  selector:
    matchLabels:
      istio: mixer
      istio-mixer-type: policy
  template:
    metadata:
      labels:
        app: policy
        istio: mixer
        istio-mixer-type: policy
      annotations:
        sidecar.istio.io/inject: "false"
{{- with .Values.mixer.policy.podAnnotations }}
{{ toYaml . | indent 8 }}
{{- end }}
    spec:
      serviceAccountName: istio-policy-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      securityContext:
        fsGroup: 1337
      volumes:
      - name: istio-certs
        secret:
          secretName: istio.istio-policy-service-account
          optional: true
      - name: uds-socket
        emptyDir: {}
      - name: policy-adapter-secret
        secret:
          secretName: policy-adapter-secret
          optional: true
      affinity:
      {{- include "nodeaffinity" . | indent 6 }}
      {{- include "podAntiAffinity" . | indent 6 }}
{{- if .Values.mixer.policy.tolerations }}
      tolerations:
{{ toYaml .Values.mixer.policy.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}
      containers:
      - name: mixer
{{- if contains "/" .Values.mixer.policy.image }}
        image: "{{ .Values.mixer.policy.image }}"
{{- else }}
        image: "{{ .Values.mixer.policy.hub | default .Values.global.hub }}/{{ .Values.mixer.policy.image }}:{{ .Values.mixer.policy.tag | default .Values.global.tag }}"
{{- end }}
        imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
        ports:
        - containerPort: 9091
        - containerPort: 15014
        - containerPort: 42422
        args:
          - --monitoringPort=15014
          - --address
{{- if .Values.global.controlPlaneSecurityEnabled }}
          - unix:///sock/mixer.socket
{{- else }}
          - tcp://0.0.0.0:9091
{{- end }}
{{- if .Values.global.logging.level }}
          - --log_output_level={{ .Values.global.logging.level }}
{{- end}}
{{- if .Values.global.logAsJson }}
          - --log_as_json
{{- end }}
{{- if .Values.global.useMCP }}
    {{- if .Values.global.controlPlaneSecurityEnabled}}
          - --configStoreURL=mcps://istio-galley.{{ .Values.global.configNamespace }}.svc:15019
    {{- else }}
          - --configStoreURL=mcp://istio-galley.{{ .Values.global.configNamespace }}.svc:9901
    {{- end }}
{{- else }}
          - --configStoreURL=k8s://
{{- end }}
          - --configDefaultNamespace={{ .Values.global.configNamespace }}
          {{- if .Values.mixer.policy.adapters.useAdapterCRDs }}
          - --useAdapterCRDs=true
          {{- else }}
          - --useAdapterCRDs=false
          {{- end }}
          - --useTemplateCRDs=false
          {{- if .Values.global.tracer.zipkin.address }}
          - --trace_zipkin_url=http://{{- .Values.global.tracer.zipkin.address }}/api/v1/spans
          {{- else }}
          - --trace_zipkin_url=http://zipkin.{{ .Values.global.telemetryNamespace }}:9411/api/v1/spans
          {{- end }}
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        {{- if .Values.mixer.policy.env }}
        {{- range $key, $val := .Values.mixer.policy.env }}
        - name: {{ $key }}
          value: "{{ $val }}"
        {{- end }}
        {{- end }}
        resources:
{{- if .Values.mixer.policy.resources }}
{{ toYaml .Values.mixer.policy.resources | indent 10 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 10 }}
{{- end }}
        securityContext:
          runAsUser: 1337
          runAsGroup: 1337
          runAsNonRoot: true
          capabilities:
            drop:
            - ALL
        volumeMounts:
{{- if .Values.global.useMCP }}
        - name: istio-certs
          mountPath: /etc/certs
          readOnly: true
{{- end }}
        - name: uds-socket
          mountPath: /sock
        - name: policy-adapter-secret
          mountPath: /var/run/secrets/istio.io/policy/adapter
          readOnly: true
        livenessProbe:
          httpGet:
            path: /version
            port: 15014
          initialDelaySeconds: 5
          periodSeconds: 5
{{- if .Values.global.controlPlaneSecurityEnabled }}
      - name: istio-proxy
{{- if contains "/" .Values.global.proxy.image }}
        image: "{{ .Values.global.proxy.image }}"
{{- else }}
        image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}"
{{- end }}
        imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
        ports:
        - containerPort: 15004
        - containerPort: 15090
          protocol: TCP
          name: http-envoy-prom
        args:
        - proxy
        - --domain
        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
        - --serviceCluster
        - istio-policy
        - --templateFile
        - /etc/istio/proxy/envoy_policy.yaml.tmpl
      {{- if .Values.global.controlPlaneSecurityEnabled }}
        - --controlPlaneAuthPolicy
        - MUTUAL_TLS
      {{- else }}
        - --controlPlaneAuthPolicy
        - NONE
      {{- end }}
      {{- if .Values.global.trustDomain }}
        - --trust-domain={{ .Values.global.trustDomain }}
      {{- end }}
      {{- if .Values.global.logAsJson }}
        - --log_as_json
      {{- end }}
        env:
        - name: JWT_POLICY
          value: {{ .Values.global.jwtPolicy }}
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        resources:
{{- if .Values.global.proxy.resources }}
{{ toYaml .Values.global.proxy.resources | indent 10 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 10 }}
{{- end }}
        volumeMounts:
        - name: istio-certs
          mountPath: /etc/certs
          readOnly: true
        - name: uds-socket
          mountPath: /sock
{{- end }}
---
`)

func chartsIstioPolicyTemplatesDeploymentYamlBytes() ([]byte, error) {
	return _chartsIstioPolicyTemplatesDeploymentYaml, nil
}

func chartsIstioPolicyTemplatesDeploymentYaml() (*asset, error) {
	bytes, err := chartsIstioPolicyTemplatesDeploymentYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-policy/templates/deployment.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioPolicyTemplatesPoddisruptionbudgetYaml = []byte(`{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: istio-policy
  namespace: {{ .Release.Namespace }}
  labels:
    app: policy
    release: {{ .Release.Name }}
    istio: mixer
    istio-mixer-type: policy
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app: policy
      istio: mixer
      istio-mixer-type: policy
---

{{- end }}
`)

func chartsIstioPolicyTemplatesPoddisruptionbudgetYamlBytes() ([]byte, error) {
	return _chartsIstioPolicyTemplatesPoddisruptionbudgetYaml, nil
}

func chartsIstioPolicyTemplatesPoddisruptionbudgetYaml() (*asset, error) {
	bytes, err := chartsIstioPolicyTemplatesPoddisruptionbudgetYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-policy/templates/poddisruptionbudget.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioPolicyTemplatesServiceYaml = []byte(`apiVersion: v1
kind: Service
metadata:
  name: istio-policy
  namespace: {{ .Release.Namespace }}
  labels:
    app: mixer
    istio: mixer
    release: {{ .Release.Name }}
spec:
  ports:
  - name: grpc-mixer
    port: 9091
  - name: grpc-mixer-mtls
    port: 15004
  - name: http-policy-monitoring
    port: 15014
  selector:
    istio: mixer
    istio-mixer-type: policy
{{- if .Values.mixer.policy.sessionAffinityEnabled }}
  sessionAffinity: ClientIP
{{- end }}
---

`)

func chartsIstioPolicyTemplatesServiceYamlBytes() ([]byte, error) {
	return _chartsIstioPolicyTemplatesServiceYaml, nil
}

func chartsIstioPolicyTemplatesServiceYaml() (*asset, error) {
	bytes, err := chartsIstioPolicyTemplatesServiceYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-policy/templates/service.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioPolicyTemplatesServiceaccountYaml = []byte(`apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end }}
metadata:
  name: istio-policy-service-account
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-policy
    release: {{ .Release.Name }}
---
`)

func chartsIstioPolicyTemplatesServiceaccountYamlBytes() ([]byte, error) {
	return _chartsIstioPolicyTemplatesServiceaccountYaml, nil
}

func chartsIstioPolicyTemplatesServiceaccountYaml() (*asset, error) {
	bytes, err := chartsIstioPolicyTemplatesServiceaccountYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-policy/templates/serviceaccount.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioPolicyValuesYaml = []byte(`mixer:
  policy:
    hub: ""
    tag: ""
    image: mixer

    replicaCount: 1
    rollingMaxSurge: 100%
    rollingMaxUnavailable: 25%
    autoscaleEnabled: true
    autoscaleMin: 1
    autoscaleMax: 5
    cpu:
      targetAverageUtilization: 80
    sessionAffinityEnabled: false
    podAnnotations: {}

    env: {}

    adapters:
      useAdapterCRDs: false
      kubernetesenv:
        enabled: true
    resources: {}
    nodeSelector: {}
    tolerations: []

    # Specify the pod anti-affinity that allows you to constrain which nodes
    # your pod is eligible to be scheduled based on labels on pods that are
    # already running on the node rather than based on labels on nodes.
    # There are currently two types of anti-affinity:
    #    "requiredDuringSchedulingIgnoredDuringExecution"
    #    "preferredDuringSchedulingIgnoredDuringExecution"
    # which denote "hard" vs. "soft" requirements, you can define your values
    # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
    # correspondingly.
    # For example:
    # podAntiAffinityLabelSelector:
    # - key: security
    #   operator: In
    #   values: S1,S2
    #   topologyKey: "kubernetes.io/hostname"
    # This pod anti-affinity rule says that the pod requires not to be scheduled
    # onto a node if that node is already running a pod with label having key
    # "security" and value "S1".
    podAntiAffinityLabelSelector: []
    podAntiAffinityTermLabelSelector: []
`)

func chartsIstioPolicyValuesYamlBytes() ([]byte, error) {
	return _chartsIstioPolicyValuesYaml, nil
}

func chartsIstioPolicyValuesYaml() (*asset, error) {
	bytes, err := chartsIstioPolicyValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-policy/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaChartYaml = []byte(`apiVersion: v1
description: A Helm chart for Kubernetes
name: grafana
version: 1.1.0
appVersion: 1.1.0
tillerVersion: ">=2.7.2"
`)

func chartsIstioTelemetryGrafanaChartYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaChartYaml, nil
}

func chartsIstioTelemetryGrafanaChartYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaDashboardsCitadelDashboardJson = []byte(`{
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "type": "dashboard"
      }
    ]
  },
  "description": "",
  "editable": true,
  "gnetId": null,
  "graphTooltip": 0,
  "links": [],
  "panels": [
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "id": 8,
      "panels": [],
      "title": "Performance",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "description": "CPU usage across Citadel instances.",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 0,
        "y": 1
      },
      "id": 10,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "rightSide": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(rate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",container=~\"citadel\", pod=~\"istio-citadel-.*\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Citadel CPU usage rate",
          "refId": "A"
        },
        {
          "expr": "irate(process_cpu_seconds_total{job=\"citadel\"}[1m])",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Citadel CPU usage irate",
          "refId": "C"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "CPU",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": "",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "description": "Citadel process memory statistics.",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 8,
        "y": 1
      },
      "id": 12,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "process_virtual_memory_bytes{job=\"citadel\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Virtual Memory",
          "refId": "A"
        },
        {
          "expr": "process_resident_memory_bytes{job=\"citadel\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Resident Memory",
          "refId": "B"
        },
        {
          "expr": "go_memstats_heap_sys_bytes{job=\"citadel\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Heap Memory Total",
          "refId": "C"
        },
        {
          "expr": "go_memstats_alloc_bytes{job=\"citadel\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Heap Memory Allocated",
          "refId": "E"
        },
        {
          "expr": "go_memstats_heap_inuse_bytes{job=\"citadel\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Heap Inuse",
          "refId": "F"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Memory",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 16,
        "y": 1
      },
      "id": 14,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "go_goroutines{job=\"citadel\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Goroutines",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Goroutines",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 7
      },
      "id": 28,
      "panels": [],
      "title": "General",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "description": "Total number of CSR requests made to Citadel.",
      "fill": 1,
      "gridPos": {
        "h": 5,
        "w": 12,
        "x": 0,
        "y": 8
      },
      "id": 30,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "citadel_server_csr_count{job=\"citadel\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "CSR Request Count",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "CSR Requests",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "description": "The number of certificates issuances that have succeeded.",
      "fill": 1,
      "gridPos": {
        "h": 5,
        "w": 12,
        "x": 12,
        "y": 8
      },
      "id": 32,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "citadel_server_success_cert_issuance_count{job=\"citadel\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Certificates Issued",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Certificates Issued",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 13
      },
      "id": 23,
      "panels": [],
      "title": "Errors",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "description": "The number of errors occurred when creating the CSR.",
      "fill": 1,
      "gridPos": {
        "h": 5,
        "w": 8,
        "x": 0,
        "y": 14
      },
      "id": 20,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "rightSide": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "citadel_secret_controller_csr_err_count{job=\"citadel\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "CSR Creation Error Count",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "CSR Creation Errors",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": "",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "fill": 1,
      "gridPos": {
        "h": 5,
        "w": 8,
        "x": 8,
        "y": 14
      },
      "id": 24,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "citadel_server_csr_parsing_err_count{job=\"citadel\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "CSR Parse Error Count",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "CSR Parse Errors",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "description": "The number of authentication failures.",
      "fill": 1,
      "gridPos": {
        "h": 5,
        "w": 8,
        "x": 16,
        "y": 14
      },
      "id": 26,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "citadel_server_authentication_failure_count{job=\"citadel\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Authentication Failure Count",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Authentication Failures",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 19
      },
      "id": 4,
      "panels": [],
      "title": "Secret Controller",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "description": "The number of certificates created due to service account creation.",
      "fill": 1,
      "gridPos": {
        "h": 5,
        "w": 8,
        "x": 0,
        "y": 20
      },
      "id": 2,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": true,
      "targets": [
        {
          "expr": "citadel_secret_controller_svc_acc_created_cert_count{job=\"citadel\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "SA Secrets Created",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Service Account Secrets Created (due to SA creation)",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "decimals": null,
          "format": "short",
          "label": "Certs Created",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "description": "The number of certificates deleted due to service account deletion.",
      "fill": 1,
      "gridPos": {
        "h": 5,
        "w": 8,
        "x": 8,
        "y": 20
      },
      "id": 16,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": true,
      "targets": [
        {
          "expr": "citadel_secret_controller_svc_acc_deleted_cert_count{job=\"citadel\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "SA Secrets Deleted",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Service Account Secrets Deleted (due to SA deletion)",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "decimals": null,
          "format": "short",
          "label": "Certs Created",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "description": "The number of certificates recreated due to secret deletion (service account still exists).",
      "fill": 1,
      "gridPos": {
        "h": 5,
        "w": 8,
        "x": 16,
        "y": 20
      },
      "id": 6,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": true,
      "targets": [
        {
          "expr": "citadel_secret_controller_secret_deleted_cert_count{job=\"citadel\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "SA Secrets Recreated",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Service Account Secrets Recreated (due to errant deletion)",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "decimals": null,
          "format": "short",
          "label": "Certs Created",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    }
  ],
  "refresh": "5s",
  "schemaVersion": 18,
  "style": "dark",
  "tags": [],
  "templating": {
    "list": []
  },
  "time": {
    "from": "now-5m",
    "to": "now"
  },
  "timepicker": {
    "refresh_intervals": [
      "5s",
      "10s",
      "30s",
      "1m",
      "5m",
      "15m",
      "30m",
      "1h",
      "2h",
      "1d"
    ],
    "time_options": [
      "5m",
      "15m",
      "1h",
      "6h",
      "12h",
      "24h",
      "2d",
      "7d",
      "30d"
    ]
  },
  "timezone": "",
  "title": "Istio Citadel Dashboard",
  "uid": "OOyOqb4Wz",
  "version": 1
}`)

func chartsIstioTelemetryGrafanaDashboardsCitadelDashboardJsonBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaDashboardsCitadelDashboardJson, nil
}

func chartsIstioTelemetryGrafanaDashboardsCitadelDashboardJson() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaDashboardsCitadelDashboardJsonBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/dashboards/citadel-dashboard.json", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaDashboardsGalleyDashboardJson = []byte(`{
  "__inputs": [
    {
      "name": "DS_PROMETHEUS",
      "label": "Prometheus",
      "description": "",
      "type": "datasource",
      "pluginId": "prometheus",
      "pluginName": "Prometheus"
    }
  ],
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "type": "dashboard"
      }
    ]
  },
  "editable": false,
  "gnetId": null,
  "graphTooltip": 0,
  "links": [],
  "panels": [
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 5,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "id": 46,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(istio_build{component=\"galley\"}) by (tag)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ tag }}",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Galley Versions",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 5
      },
      "id": 40,
      "panels": [],
      "title": "Resource Usage",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 8,
        "w": 6,
        "x": 0,
        "y": 6
      },
      "id": 36,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "process_virtual_memory_bytes{job=\"galley\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Virtual Memory",
          "refId": "A"
        },
        {
          "expr": "process_resident_memory_bytes{job=\"galley\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Resident Memory",
          "refId": "B"
        },
        {
          "expr": "go_memstats_heap_sys_bytes{job=\"galley\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "heap sys",
          "refId": "C"
        },
        {
          "expr": "go_memstats_heap_alloc_bytes{job=\"galley\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "heap alloc",
          "refId": "D"
        },
        {
          "expr": "go_memstats_alloc_bytes{job=\"galley\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Alloc",
          "refId": "F"
        },
        {
          "expr": "go_memstats_heap_inuse_bytes{job=\"galley\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Heap in-use",
          "refId": "G"
        },
        {
          "expr": "go_memstats_stack_inuse_bytes{job=\"galley\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Stack in-use",
          "refId": "H"
        },
        {
          "expr": "sum(container_memory_usage_bytes{job=\"kubernetes-cadvisor\",container=~\"galley\", pod=~\"istio-galley-.*\"})",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Total (kis)",
          "refId": "E"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Memory",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 8,
        "w": 6,
        "x": 6,
        "y": 6
      },
      "id": 38,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(rate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",container=~\"galley\", pod=~\"istio-galley-.*\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Total (k8s)",
          "refId": "A"
        },
        {
          "expr": "sum(rate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",container=~\"galley\", pod=~\"istio-galley-.*\"}[1m])) by (container)",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "{{ container }} (k8s)",
          "refId": "B"
        },
        {
          "expr": "irate(process_cpu_seconds_total{job=\"galley\"}[1m])",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "galley (self-reported)",
          "refId": "C"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "CPU",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 8,
        "w": 6,
        "x": 12,
        "y": 6
      },
      "id": 42,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "process_open_fds{job=\"galley\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Open FDs (galley)",
          "refId": "A"
        },
        {
          "expr": "container_fs_usage_bytes{job=\"kubernetes-cadvisor\",container=~\"galley\", pod=~\"istio-galley-.*\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "{{ container }} ",
          "refId": "B"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Disk",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 8,
        "w": 6,
        "x": 18,
        "y": 6
      },
      "id": 44,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "go_goroutines{job=\"galley\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "goroutines_total",
          "refId": "A"
        },
        {
          "expr": "istio_mcp_clients_total{component=\"galley\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "clients_total",
          "refId": "B"
        },
        {
          "expr": "go_goroutines{job=\"galley\"}/sum(istio_mcp_clients_total{component=\"galley\"}) without (component)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "avg_goroutines_per_client",
          "refId": "C"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Goroutines",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 14
      },
      "id": 10,
      "panels": [],
      "title": "Runtime",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 0,
        "y": 15
      },
      "id": 2,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(rate(galley_runtime_strategy_on_change_total[1m])) * 60",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Strategy Change Events",
          "refId": "A"
        },
        {
          "expr": "sum(rate(galley_runtime_processor_events_processed_total[1m])) * 60",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Processed Events",
          "refId": "B"
        },
        {
          "expr": "sum(rate(galley_runtime_processor_snapshots_published_total[1m])) * 60",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Snapshot Published",
          "refId": "C"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Event Rates",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": "Events/min",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": "",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 8,
        "y": 15
      },
      "id": 4,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(rate(galley_runtime_strategy_timer_max_time_reached_total[1m])) * 60",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Max Time Reached",
          "refId": "A"
        },
        {
          "expr": "sum(rate(galley_runtime_strategy_timer_quiesce_reached_total[1m])) * 60",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Quiesce Reached",
          "refId": "B"
        },
        {
          "expr": "sum(rate(galley_runtime_strategy_timer_resets_total[1m])) * 60",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Timer Resets",
          "refId": "C"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Timer Rates",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": "Events/min",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 16,
        "y": 15
      },
      "id": 8,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 3,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": true,
      "steppedLine": false,
      "targets": [
        {
          "expr": "histogram_quantile(0.50, sum by (le) (galley_runtime_processor_snapshot_events_total_bucket))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "P50",
          "refId": "A"
        },
        {
          "expr": "histogram_quantile(0.90, sum by (le) (galley_runtime_processor_snapshot_events_total_bucket))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "P90",
          "refId": "B"
        },
        {
          "expr": "histogram_quantile(0.95, sum by (le) (galley_runtime_processor_snapshot_events_total_bucket))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "P95",
          "refId": "C"
        },
        {
          "expr": "histogram_quantile(0.99, sum by (le) (galley_runtime_processor_snapshot_events_total_bucket))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "P99",
          "refId": "D"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Events Per Snapshot",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 8,
        "y": 21
      },
      "id": 6,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum by (collection) (galley_runtime_state_type_instances_total)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ collection }}",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "State Type Instances",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": "Count",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 27
      },
      "id": 34,
      "panels": [],
      "title": "Validation",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 0,
        "y": 28
      },
      "id": 28,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "galley_validation_cert_key_updates{}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Key Updates",
          "refId": "A"
        },
        {
          "expr": "galley_validation_cert_key_update_errors{}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Key Update Errors: {{ error }}",
          "refId": "B"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Validation Webhook Certificate",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 8,
        "y": 28
      },
      "id": 30,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(galley_validation_passed{}) by (group, version, resource)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Passed: {{ group }}/{{ version }}/{{resource}}",
          "refId": "A"
        },
        {
          "expr": "sum(galley_validation_failed{}) by (group, version, resource, reason)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Failed: {{ group }}/{{ version }}/{{resource}} ({{ reason}})",
          "refId": "B"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Resource Validation",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 16,
        "y": 28
      },
      "id": 32,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(galley_validation_http_error{}) by (status)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ status }}",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Validation HTTP Errors",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 34
      },
      "id": 12,
      "panels": [],
      "title": "Kubernetes Source",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 0,
        "y": 35
      },
      "id": 14,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "rate(galley_source_kube_event_success_total[1m]) * 60",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Success",
          "refId": "A"
        },
        {
          "expr": "rate(galley_source_kube_event_error_total[1m]) * 60",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Error",
          "refId": "B"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Source Event Rate",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": "Events/min",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 16,
        "y": 35
      },
      "id": 24,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "rate(galley_source_kube_dynamic_converter_failure_total[1m]) * 60",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Error",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Kubernetes Object Conversion Failures",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": "Failures/min",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 41
      },
      "id": 18,
      "panels": [],
      "title": "Mesh Configuration Protocol",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 0,
        "y": 42
      },
      "id": 20,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(istio_mcp_clients_total{component=\"galley\"})",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Clients",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Connected Clients",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 8,
        "y": 42
      },
      "id": 22,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum by(collection)(irate(istio_mcp_request_acks_total{component=\"galley\"}[1m]) * 60)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Request ACKs",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": "ACKs/min",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 16,
        "y": 42
      },
      "id": 26,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "rate(istio_mcp_request_nacks_total{component=\"galley\"}[1m]) * 60",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Request NACKs",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": "NACKs/min",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    }
  ],
  "refresh": "5s",
  "schemaVersion": 16,
  "style": "dark",
  "tags": [],
  "templating": {
    "list": []
  },
  "time": {
    "from": "now-5m",
    "to": "now"
  },
  "timepicker": {
    "refresh_intervals": [
      "5s",
      "10s",
      "30s",
      "1m",
      "5m",
      "15m",
      "30m",
      "1h",
      "2h",
      "1d"
    ],
    "time_options": [
      "5m",
      "15m",
      "1h",
      "6h",
      "12h",
      "24h",
      "2d",
      "7d",
      "30d"
    ]
  },
  "timezone": "",
  "title": "Istio Galley Dashboard",
  "uid": "TSEY6jLmk",
  "version": 1
}
`)

func chartsIstioTelemetryGrafanaDashboardsGalleyDashboardJsonBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaDashboardsGalleyDashboardJson, nil
}

func chartsIstioTelemetryGrafanaDashboardsGalleyDashboardJson() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaDashboardsGalleyDashboardJsonBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/dashboards/galley-dashboard.json", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaDashboardsIstioMeshDashboardJson = []byte(`{
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "type": "dashboard"
      }
    ]
  },
  "editable": false,
  "gnetId": null,
  "graphTooltip": 0,
  "id": null,
  "links": [],
  "panels": [
    {
      "content": "<div>\n  <div style=\"position: absolute; bottom: 0\">\n    <a href=\"https://istio.io\" target=\"_blank\" style=\"font-size: 30px; text-decoration: none; color: inherit\"><img src=\"https://istio.io/img/istio-logo.svg\" style=\"height: 50px\"> Istio</a>\n  </div>\n  <div style=\"position: absolute; bottom: 0; right: 0; font-size: 15px\">\n    Istio is an <a href=\"https://github.com/istio/istio\" target=\"_blank\">open platform</a> that provides a uniform way to connect,\n    <a href=\"https://istio.io/docs/concepts/traffic-management/overview.html\" target=\"_blank\">manage</a>, and \n    <a href=\"https://istio.io/docs/concepts/network-and-auth/auth.html\" target=\"_blank\">secure</a> microservices.\n    <br>\n    Need help? Join the <a href=\"https://istio.io/community/\" target=\"_blank\">Istio community</a>.\n  </div>\n</div>",
      "gridPos": {
        "h": 3,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "height": "50px",
      "id": 13,
      "links": [],
      "mode": "html",
      "style": {
        "font-size": "18pt"
      },
      "title": "",
      "transparent": true,
      "type": "text"
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "rgba(245, 54, 54, 0.9)",
        "rgba(237, 129, 40, 0.89)",
        "rgba(50, 172, 45, 0.97)"
      ],
      "datasource": "Prometheus",
      "format": "ops",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": true
      },
      "gridPos": {
        "h": 3,
        "w": 6,
        "x": 0,
        "y": 3
      },
      "id": 20,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": true,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "round(sum(irate(istio_requests_total{reporter=\"destination\"}[1m])), 0.001)",
          "intervalFactor": 1,
          "refId": "A",
          "step": 4
        }
      ],
      "thresholds": "",
      "title": "Global Request Volume",
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "avg"
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "rgba(245, 54, 54, 0.9)",
        "rgba(237, 129, 40, 0.89)",
        "rgba(50, 172, 45, 0.97)"
      ],
      "datasource": "Prometheus",
      "format": "percentunit",
      "gauge": {
        "maxValue": 100,
        "minValue": 80,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": false
      },
      "gridPos": {
        "h": 3,
        "w": 6,
        "x": 6,
        "y": 3
      },
      "id": 21,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": true,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "sum(rate(istio_requests_total{reporter=\"destination\", response_code!~\"5.*\"}[1m])) / sum(rate(istio_requests_total{reporter=\"destination\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "A",
          "step": 4
        }
      ],
      "thresholds": "95, 99, 99.5",
      "title": "Global Success Rate (non-5xx responses)",
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "avg"
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "rgba(245, 54, 54, 0.9)",
        "rgba(237, 129, 40, 0.89)",
        "rgba(50, 172, 45, 0.97)"
      ],
      "datasource": "Prometheus",
      "format": "ops",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": true
      },
      "gridPos": {
        "h": 3,
        "w": 6,
        "x": 12,
        "y": 3
      },
      "id": 22,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": true,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "sum(irate(istio_requests_total{reporter=\"destination\", response_code=~\"4.*\"}[1m])) ",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "A",
          "step": 4
        }
      ],
      "thresholds": "",
      "title": "4xxs",
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "avg"
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "rgba(245, 54, 54, 0.9)",
        "rgba(237, 129, 40, 0.89)",
        "rgba(50, 172, 45, 0.97)"
      ],
      "datasource": "Prometheus",
      "format": "ops",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": true
      },
      "gridPos": {
        "h": 3,
        "w": 6,
        "x": 18,
        "y": 3
      },
      "id": 23,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": true,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "sum(irate(istio_requests_total{reporter=\"destination\", response_code=~\"5.*\"}[1m])) ",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "A",
          "step": 4
        }
      ],
      "thresholds": "",
      "title": "5xxs",
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "avg"
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "#299c46",
        "rgba(237, 129, 40, 0.89)",
        "#d44a3a"
      ],
      "format": "none",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": true
      },
      "gridPos": {
        "h": 3,
        "w": 6,
        "x": 0,
        "y": 6
      },
      "id": 113,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": false,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "avg(galley_istio_networking_virtualservices)",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "A"
        }
      ],
      "thresholds": "",
      "timeFrom": null,
      "timeShift": null,
      "title": "Virtual Services",
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "current"
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "#299c46",
        "rgba(237, 129, 40, 0.89)",
        "#d44a3a"
      ],
      "format": "none",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": true
      },
      "gridPos": {
        "h": 3,
        "w": 6,
        "x": 6,
        "y": 6
      },
      "id": 114,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": false,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "avg(galley_istio_networking_destinationrules)",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "A"
        }
      ],
      "thresholds": "",
      "timeFrom": null,
      "timeShift": null,
      "title": "Destination Rules",
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "current"
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "#299c46",
        "rgba(237, 129, 40, 0.89)",
        "#d44a3a"
      ],
      "format": "none",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": true
      },
      "gridPos": {
        "h": 3,
        "w": 6,
        "x": 12,
        "y": 6
      },
      "id": 115,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": false,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "avg(galley_istio_networking_gateways)",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "A"
        }
      ],
      "thresholds": "",
      "timeFrom": null,
      "timeShift": null,
      "title": "Gateways",
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "current"
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "#299c46",
        "rgba(237, 129, 40, 0.89)",
        "#d44a3a"
      ],
      "format": "none",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": true
      },
      "gridPos": {
        "h": 3,
        "w": 6,
        "x": 18,
        "y": 6
      },
      "id": 116,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": false,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "avg(galley_istio_authentication_meshpolicies)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "refId": "A"
        }
      ],
      "thresholds": "",
      "timeFrom": null,
      "timeShift": null,
      "title": "Authentication Mesh Policies",
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "current"
    },
    {
      "columns": [],
      "datasource": "Prometheus",
      "fontSize": "100%",
      "gridPos": {
        "h": 21,
        "w": 24,
        "x": 0,
        "y": 9
      },
      "hideTimeOverride": false,
      "id": 73,
      "links": [],
      "pageSize": null,
      "repeat": null,
      "repeatDirection": "v",
      "scroll": true,
      "showHeader": true,
      "sort": {
        "col": 4,
        "desc": true
      },
      "styles": [
        {
          "alias": "Workload",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "link": false,
          "linkTargetBlank": false,
          "linkTooltip": "Workload dashboard",
          "linkUrl": "/dashboard/db/istio-workload-dashboard?var-namespace=$__cell_2&var-workload=$__cell_",
          "pattern": "destination_workload",
          "preserveFormat": false,
          "sanitize": false,
          "thresholds": [],
          "type": "hidden",
          "unit": "short"
        },
        {
          "alias": "",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "pattern": "Time",
          "thresholds": [],
          "type": "hidden",
          "unit": "short"
        },
        {
          "alias": "Requests",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "pattern": "Value #A",
          "thresholds": [],
          "type": "number",
          "unit": "ops"
        },
        {
          "alias": "P50 Latency",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "pattern": "Value #B",
          "thresholds": [],
          "type": "number",
          "unit": "s"
        },
        {
          "alias": "P90 Latency",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "pattern": "Value #D",
          "thresholds": [],
          "type": "number",
          "unit": "s"
        },
        {
          "alias": "P99 Latency",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "pattern": "Value #E",
          "thresholds": [],
          "type": "number",
          "unit": "s"
        },
        {
          "alias": "Success Rate",
          "colorMode": "cell",
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "pattern": "Value #F",
          "thresholds": [
            ".95",
            " 1.00"
          ],
          "type": "number",
          "unit": "percentunit"
        },
        {
          "alias": "Workload",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "link": true,
          "linkTooltip": "$__cell dashboard",
          "linkUrl": "/dashboard/db/istio-workload-dashboard?var-workload=$__cell_2&var-namespace=$__cell_3",
          "pattern": "destination_workload_var",
          "thresholds": [],
          "type": "number",
          "unit": "short"
        },
        {
          "alias": "Service",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "link": true,
          "linkTooltip": "$__cell dashboard",
          "linkUrl": "/dashboard/db/istio-service-dashboard?var-service=$__cell",
          "pattern": "destination_service",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "alias": "",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "pattern": "destination_workload_namespace",
          "thresholds": [],
          "type": "hidden",
          "unit": "short"
        }
      ],
      "targets": [
        {
          "expr": "label_join(sum(rate(istio_requests_total{reporter=\"destination\", response_code=\"200\"}[1m])) by (destination_workload, destination_workload_namespace, destination_service), \"destination_workload_var\", \".\", \"destination_workload\", \"destination_workload_namespace\")",
          "format": "table",
          "hide": false,
          "instant": true,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload}}.{{ destination_workload_namespace }}",
          "refId": "A"
        },
        {
          "expr": "label_join((histogram_quantile(0.50, sum(rate(istio_request_duration_milliseconds_bucket{reporter=\"destination\"}[1m])) by (le, destination_workload, destination_workload_namespace)) / 1000) or histogram_quantile(0.50, sum(rate(istio_request_duration_seconds_bucket{reporter=\"destination\"}[1m])) by (le, destination_workload, destination_workload_namespace)), \"destination_workload_var\", \".\", \"destination_workload\", \"destination_workload_namespace\")",
          "format": "table",
          "hide": false,
          "instant": true,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload}}.{{ destination_workload_namespace }}",
          "refId": "B"
        },
        {
          "expr": "label_join((histogram_quantile(0.90, sum(rate(istio_request_duration_milliseconds_bucket{reporter=\"destination\"}[1m])) by (le, destination_workload, destination_workload_namespace)) / 1000) or histogram_quantile(0.90, sum(rate(istio_request_duration_seconds_bucket{reporter=\"destination\"}[1m])) by (le, destination_workload, destination_workload_namespace)), \"destination_workload_var\", \".\", \"destination_workload\", \"destination_workload_namespace\")",
          "format": "table",
          "hide": false,
          "instant": true,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }}",
          "refId": "D"
        },
        {
          "expr": "label_join((histogram_quantile(0.99, sum(rate(istio_request_duration_milliseconds_bucket{reporter=\"destination\"}[1m])) by (le, destination_workload, destination_workload_namespace)) / 1000) or histogram_quantile(0.99, sum(rate(istio_request_duration_seconds_bucket{reporter=\"destination\"}[1m])) by (le, destination_workload, destination_workload_namespace)), \"destination_workload_var\", \".\", \"destination_workload\", \"destination_workload_namespace\")",
          "format": "table",
          "hide": false,
          "instant": true,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }}",
          "refId": "E"
        },
        {
          "expr": "label_join((sum(rate(istio_requests_total{reporter=\"destination\", response_code!~\"5.*\"}[1m])) by (destination_workload, destination_workload_namespace) / sum(rate(istio_requests_total{reporter=\"destination\"}[1m])) by (destination_workload, destination_workload_namespace)), \"destination_workload_var\", \".\", \"destination_workload\", \"destination_workload_namespace\")",
          "format": "table",
          "hide": false,
          "instant": true,
          "interval": "",
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }}",
          "refId": "F"
        }
      ],
      "timeFrom": null,
      "title": "HTTP/GRPC Workloads",
      "transform": "table",
      "type": "table"
    },
    {
      "columns": [],
      "datasource": "Prometheus",
      "fontSize": "100%",
      "gridPos": {
        "h": 18,
        "w": 24,
        "x": 0,
        "y": 30
      },
      "hideTimeOverride": false,
      "id": 109,
      "links": [],
      "pageSize": null,
      "repeatDirection": "v",
      "scroll": true,
      "showHeader": true,
      "sort": {
        "col": 2,
        "desc": true
      },
      "styles": [
        {
          "alias": "Workload",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "link": false,
          "linkTargetBlank": false,
          "linkTooltip": "$__cell dashboard",
          "linkUrl": "/dashboard/db/istio-tcp-workload-dashboard?var-namespace=$__cell_2&&var-workload=$__cell",
          "pattern": "destination_workload",
          "preserveFormat": false,
          "sanitize": false,
          "thresholds": [],
          "type": "hidden",
          "unit": "short"
        },
        {
          "alias": "Bytes Sent",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "pattern": "Value #A",
          "thresholds": [
            ""
          ],
          "type": "number",
          "unit": "Bps"
        },
        {
          "alias": "Bytes Received",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "pattern": "Value #C",
          "thresholds": [],
          "type": "number",
          "unit": "Bps"
        },
        {
          "alias": "",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "pattern": "Time",
          "thresholds": [],
          "type": "hidden",
          "unit": "short"
        },
        {
          "alias": "Workload",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "link": true,
          "linkTooltip": "$__cell dashboard",
          "linkUrl": "/dashboard/db/istio-workload-dashboard?var-namespace=$__cell_3&var-workload=$__cell_2",
          "pattern": "destination_workload_var",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "alias": "",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "pattern": "destination_workload_namespace",
          "thresholds": [],
          "type": "hidden",
          "unit": "short"
        },
        {
          "alias": "Service",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "link": true,
          "linkTooltip": "$__cell dashboard",
          "linkUrl": "/dashboard/db/istio-service-dashboard?var-service=$__cell",
          "pattern": "destination_service",
          "thresholds": [],
          "type": "number",
          "unit": "short"
        }
      ],
      "targets": [
        {
          "expr": "label_join(sum(rate(istio_tcp_received_bytes_total{reporter=\"source\"}[1m])) by (destination_workload, destination_workload_namespace, destination_service), \"destination_workload_var\", \".\", \"destination_workload\", \"destination_workload_namespace\")",
          "format": "table",
          "hide": false,
          "instant": true,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}",
          "refId": "C"
        },
        {
          "expr": "label_join(sum(rate(istio_tcp_sent_bytes_total{reporter=\"source\"}[1m])) by (destination_workload, destination_workload_namespace, destination_service), \"destination_workload_var\", \".\", \"destination_workload\", \"destination_workload_namespace\")",
          "format": "table",
          "hide": false,
          "instant": true,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}",
          "refId": "A"
        }
      ],
      "timeFrom": null,
      "title": "TCP Workloads",
      "transform": "table",
      "type": "table"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 9,
        "w": 24,
        "x": 0,
        "y": 48
      },
      "id": 111,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "rightSide": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(istio_build) by (component, tag)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ component }}: {{ tag }}",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Istio Components by Version",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    }
  ],
  "refresh": "5s",
  "schemaVersion": 18,
  "style": "dark",
  "tags": [],
  "templating": {
    "list": []
  },
  "time": {
    "from": "now-5m",
    "to": "now"
  },
  "timepicker": {
    "refresh_intervals": [
      "5s",
      "10s",
      "30s",
      "1m",
      "5m",
      "15m",
      "30m",
      "1h",
      "2h",
      "1d"
    ],
    "time_options": [
      "5m",
      "15m",
      "1h",
      "6h",
      "12h",
      "24h",
      "2d",
      "7d",
      "30d"
    ]
  },
  "timezone": "browser",
  "title": "Istio Mesh Dashboard",
  "uid": "G8wLrJIZk",
  "version": 5
}
`)

func chartsIstioTelemetryGrafanaDashboardsIstioMeshDashboardJsonBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaDashboardsIstioMeshDashboardJson, nil
}

func chartsIstioTelemetryGrafanaDashboardsIstioMeshDashboardJson() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaDashboardsIstioMeshDashboardJsonBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/dashboards/istio-mesh-dashboard.json", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaDashboardsIstioPerformanceDashboardJson = []byte(`{
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "type": "dashboard"
      }
    ]
  },
  "editable": false,
  "gnetId": null,
  "graphTooltip": 0,
  "id": 9,
  "links": [],
  "panels": [
    {
      "collapsed": true,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "id": 21,
      "panels": [
        {
          "content": "The charts on this dashboard are intended to show Istio main components cost in terms resources utilization under steady load.\n\n- **vCPU/1k rps:** shows vCPU utilization by the main Istio components normalized by 1000 requests/second. When idle or low traffic, this chart will be blank. The curve for istio-proxy refers to the services sidecars only.\n- **vCPU:** vCPU utilization by Istio components, not normalized.\n- **Memory:** memory footprint for the components. Telemetry and policy are normalized by 1k rps, and no data is shown  when there is no traffic. For ingress and istio-proxy, the data is per instance.\n- **Bytes transferred/ sec:** shows the number of bytes flowing through each Istio component.\n\n\n",
          "gridPos": {
            "h": 6,
            "w": 24,
            "x": 0,
            "y": 1
          },
          "id": 19,
          "links": [],
          "mode": "markdown",
          "timeFrom": null,
          "timeShift": null,
          "title": "Performance Dashboard README",
          "transparent": true,
          "type": "text"
        }
      ],
      "title": "Performance Dashboard Notes",
      "type": "row"
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 1
      },
      "id": 6,
      "panels": [],
      "title": "vCPU Usage",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "fill": 1,
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 0,
        "y": 2
      },
      "id": 4,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "(sum(irate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",pod=~\"istio-telemetry-.*\",container=~\"mixer|istio-proxy\"}[1m]))/ (round(sum(irate(istio_requests_total[1m])), 0.001)/1000))/ (sum(irate(istio_requests_total{source_workload=\"istio-ingressgateway\"}[1m])) >bool 10)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "istio-telemetry",
          "refId": "A"
        },
        {
          "expr": "(sum(irate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",pod=~\"istio-ingressgateway-.*\",container=\"istio-proxy\"}[1m])) / (round(sum(irate(istio_requests_total{source_workload=\"istio-ingressgateway\", reporter=\"source\"}[1m])), 0.001)/1000))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "istio-ingressgateway",
          "refId": "B"
        },
        {
          "expr": "(sum(irate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",namespace!=\"istio-system\",container=\"istio-proxy\"}[1m]))/ (round(sum(irate(istio_requests_total[1m])), 0.001)/1000))/ (sum(irate(istio_requests_total{source_workload=\"istio-ingressgateway\"}[1m])) >bool 10)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "istio-proxy",
          "refId": "C"
        },
        {
          "expr": "(sum(irate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",pod=~\"istio-policy-.*\",container=~\"mixer|istio-proxy\"}[1m]))/ (round(sum(irate(istio_requests_total[1m])), 0.001)/1000))/ (sum(irate(istio_requests_total{source_workload=\"istio-ingressgateway\"}[1m])) >bool 10)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "istio-policy",
          "refId": "D"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "vCPU / 1k rps",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "fill": 1,
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 12,
        "y": 2
      },
      "id": 7,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(rate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",pod=~\"istio-telemetry-.*\",container=~\"mixer|istio-proxy\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "istio-telemetry",
          "refId": "A"
        },
        {
          "expr": "sum(rate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",pod=~\"istio-ingressgateway-.*\",container=\"istio-proxy\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "istio-ingressgateway",
          "refId": "B"
        },
        {
          "expr": "sum(rate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",namespace!=\"istio-system\",container=\"istio-proxy\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "istio-proxy",
          "refId": "C"
        },
        {
          "expr": "sum(rate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",pod=~\"istio-policy-.*\",container=~\"mixer|istio-proxy\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "istio-policy",
          "refId": "D"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "vCPU",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 10
      },
      "id": 13,
      "panels": [],
      "title": "Memory and Data Rates",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "fill": 1,
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 0,
        "y": 11
      },
      "id": 902,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "(sum(container_memory_usage_bytes{job=\"kubernetes-cadvisor\",pod=~\"istio-telemetry-.*\"}) / (sum(irate(istio_requests_total[1m])) / 1000)) / (sum(irate(istio_requests_total{source_workload=\"istio-ingressgateway\"}[1m])) >bool 10)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "istio-telemetry / 1k rps",
          "refId": "A"
        },
        {
          "expr": "sum(container_memory_usage_bytes{job=\"kubernetes-cadvisor\",pod=~\"istio-ingressgateway-.*\"}) / count(container_memory_usage_bytes{job=\"kubernetes-cadvisor\",pod=~\"istio-ingressgateway-.*\",container!=\"POD\"})",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "per istio-ingressgateway",
          "refId": "B"
        },
        {
          "expr": "sum(container_memory_usage_bytes{job=\"kubernetes-cadvisor\",namespace!=\"istio-system\",container=\"istio-proxy\"}) / count(container_memory_usage_bytes{job=\"kubernetes-cadvisor\",namespace!=\"istio-system\",container=\"istio-proxy\"})",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "per istio proxy",
          "refId": "C"
        },
        {
          "expr": "(sum(container_memory_usage_bytes{job=\"kubernetes-cadvisor\",pod=~\"istio-policy-.*\"}) / (sum(irate(istio_requests_total[1m])) / 1000))/ (sum(irate(istio_requests_total{source_workload=\"istio-ingressgateway\"}[1m])) >bool 10)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "istio-policy / 1k rps",
          "refId": "D"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Memory Usage",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "fill": 1,
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 12,
        "y": 11
      },
      "id": 11,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(irate(istio_response_bytes_sum{destination_workload=\"istio-telemetry\"}[1m])) + sum(irate(istio_request_bytes_sum{destination_workload=\"istio-telemetry\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "istio-telemetry",
          "refId": "A"
        },
        {
          "expr": "sum(irate(istio_response_bytes_sum{source_workload=\"istio-ingressgateway\", reporter=\"source\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "istio-ingressgateway",
          "refId": "B"
        },
        {
          "expr": "sum(irate(istio_response_bytes_sum{source_workload_namespace!=\"istio-system\", reporter=\"source\"}[1m])) + sum(irate(istio_response_bytes_sum{destination_workload_namespace!=\"istio-system\", reporter=\"destination\"}[1m])) + sum(irate(istio_request_bytes_sum{source_workload_namespace!=\"istio-system\", reporter=\"source\"}[1m])) + sum(irate(istio_request_bytes_sum{destination_workload_namespace!=\"istio-system\", reporter=\"destination\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "istio-proxy",
          "refId": "C"
        },
        {
          "expr": "sum(irate(istio_response_bytes_sum{destination_workload=\"istio-policy\"}[1m])) + sum(irate(istio_request_bytes_sum{destination_workload=\"istio-policy\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "istio_policy",
          "refId": "D"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Bytes transferred / sec",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "Bps",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 19
      },
      "id": 17,
      "panels": [],
      "title": "Istio Component Versions",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "fill": 1,
      "gridPos": {
        "h": 8,
        "w": 24,
        "x": 0,
        "y": 20
      },
      "id": 15,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(istio_build) by (component, tag)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ component }}: {{ tag }}",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Istio Components by Version",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 31
      },
      "id": 71,
      "panels": [],
      "title": "Proxy Resource Usage",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 0,
        "y": 32
      },
      "id": 72,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(container_memory_usage_bytes{job=\"kubernetes-cadvisor\",container=\"istio-proxy\"})",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "{{ container }} (k8s)",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Memory",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 6,
        "y": 32
      },
      "id": 73,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(rate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",container=\"istio-proxy\"}[1m]))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "Total (k8s)",
          "refId": "A",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "vCPU",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 12,
        "y": 32
      },
      "id": 702,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(container_fs_usage_bytes{job=\"kubernetes-cadvisor\", container=\"istio-proxy\"})",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "{{ container }}",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Disk",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "bytes",
          "label": "",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "decimals": null,
          "format": "none",
          "label": "",
          "logBase": 1024,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 39
      },
      "id": 69,
      "panels": [],
      "title": "Pilot Resource Usage",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 0,
        "y": 40
      },
      "id": 5,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "process_virtual_memory_bytes{job=\"pilot\"}",
          "format": "time_series",
          "instant": false,
          "intervalFactor": 2,
          "legendFormat": "Virtual Memory",
          "refId": "I",
          "step": 2
        },
        {
          "expr": "process_resident_memory_bytes{job=\"pilot\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Resident Memory",
          "refId": "H",
          "step": 2
        },
        {
          "expr": "go_memstats_heap_sys_bytes{job=\"pilot\"}",
          "format": "time_series",
          "hide": true,
          "intervalFactor": 2,
          "legendFormat": "heap sys",
          "refId": "A"
        },
        {
          "expr": "go_memstats_heap_alloc_bytes{job=\"pilot\"}",
          "format": "time_series",
          "hide": true,
          "intervalFactor": 2,
          "legendFormat": "heap alloc",
          "refId": "D"
        },
        {
          "expr": "go_memstats_alloc_bytes{job=\"pilot\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Alloc",
          "refId": "F",
          "step": 2
        },
        {
          "expr": "go_memstats_heap_inuse_bytes{job=\"pilot\"}",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "Heap in-use",
          "refId": "E",
          "step": 2
        },
        {
          "expr": "go_memstats_stack_inuse_bytes{job=\"pilot\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Stack in-use",
          "refId": "G",
          "step": 2
        },
        {
          "expr": "sum(container_memory_usage_bytes{job=\"kubernetes-cadvisor\",container=~\"discovery|istio-proxy\", pod=~\"istiod-.*\"})",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "Total (k8s)",
          "refId": "C",
          "step": 2
        },
        {
          "expr": "container_memory_usage_bytes{job=\"kubernetes-cadvisor\",container=~\"discovery|istio-proxy\", pod=~\"istiod-.*\"}",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "{{ container }} (k8s)",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Memory",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 6,
        "y": 40
      },
      "id": 602,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(rate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",container=~\"discovery|istio-proxy\", pod=~\"istiod-.*\"}[1m]))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "Total (k8s)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "sum(rate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",container=~\"discovery|istio-proxy\", pod=~\"istiod-.*\"}[1m])) by (container)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "{{ container }} (k8s)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "irate(process_cpu_seconds_total{job=\"pilot\"}[1m])",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "pilot (self-reported)",
          "refId": "C",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "vCPU",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 12,
        "y": 40
      },
      "id": 74,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "process_open_fds{job=\"pilot\"}",
          "format": "time_series",
          "hide": true,
          "instant": false,
          "interval": "",
          "intervalFactor": 2,
          "legendFormat": "Open FDs (pilot)",
          "refId": "A"
        },
        {
          "expr": "container_fs_usage_bytes{job=\"kubernetes-cadvisor\", container=~\"discovery|istio-proxy\", pod=~\"istiod-.*\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "{{ container }}",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Disk",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "bytes",
          "label": "",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "decimals": null,
          "format": "none",
          "label": "",
          "logBase": 1024,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 18,
        "y": 40
      },
      "id": 402,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": false,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "go_goroutines{job=\"pilot\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Number of Goroutines",
          "refId": "A",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Goroutines",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": "",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 47
      },
      "id": 93,
      "panels": [],
      "title": "Mixer Resource Usage",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 0,
        "y": 48
      },
      "id": 94,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "process_virtual_memory_bytes{job=~\"istio-telemetry|istio-policy\"}",
          "format": "time_series",
          "instant": false,
          "intervalFactor": 2,
          "legendFormat": "Virtual Memory",
          "refId": "I",
          "step": 2
        },
        {
          "expr": "process_resident_memory_bytes{job=~\"istio-telemetry|istio-policy\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Resident Memory",
          "refId": "H",
          "step": 2
        },
        {
          "expr": "go_memstats_heap_sys_bytes{job=~\"istio-telemetry|istio-policy\"}",
          "format": "time_series",
          "hide": true,
          "intervalFactor": 2,
          "legendFormat": "heap sys",
          "refId": "A"
        },
        {
          "expr": "go_memstats_heap_alloc_bytes{job=~\"istio-telemetry|istio-policy\"}",
          "format": "time_series",
          "hide": true,
          "intervalFactor": 2,
          "legendFormat": "heap alloc",
          "refId": "D"
        },
        {
          "expr": "go_memstats_alloc_bytes{job=~\"istio-telemetry|istio-policy\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Alloc",
          "refId": "F",
          "step": 2
        },
        {
          "expr": "go_memstats_heap_inuse_bytes{job=~\"istio-telemetry|istio-policy\"}",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "Heap in-use",
          "refId": "E",
          "step": 2
        },
        {
          "expr": "go_memstats_stack_inuse_bytes{job=~\"istio-policy|istio-telemetry\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Stack in-use",
          "refId": "G",
          "step": 2
        },
        {
          "expr": "sum(container_memory_usage_bytes{job=\"kubernetes-cadvisor\",container=~\"mixer|istio-proxy\", pod=~\"istio-telemetry-.*\"})",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "Total (k8s)",
          "refId": "C",
          "step": 2
        },
        {
          "expr": "container_memory_usage_bytes{job=\"kubernetes-cadvisor\",container=~\"mixer|istio-proxy\", pod=~\"istio-telemetry-.*\"}",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "{{ container }} (k8s)",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Memory",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 6,
        "y": 48
      },
      "id": 95,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(rate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",container=~\"mixer|istio-proxy\", pod=~\"istio-telemetry-.*\"}[1m]))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "Total (k8s)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "sum(rate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",container=~\"mixer|istio-proxy\", pod=~\"istio-telemetry-.*\"}[1m])) by (container)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "{{ container }} (k8s)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "irate(process_cpu_seconds_total{job=~\"istio-policy|istio-telemetry\"}[1m])",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "mixer (self-reported)",
          "refId": "C",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "vCPU",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 12,
        "y": 48
      },
      "id": 96,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "process_open_fds{job=~\"istio-policy|istio-telemetry\"}",
          "format": "time_series",
          "hide": true,
          "instant": false,
          "interval": "",
          "intervalFactor": 2,
          "legendFormat": "Open FDs (pilot)",
          "refId": "A"
        },
        {
          "expr": "container_fs_usage_bytes{job=\"kubernetes-cadvisor\", container=~\"mixer|istio-proxy\", pod=~\"istio-telemetry-.*\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "{{ container }}",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Disk",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "bytes",
          "label": "",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "decimals": null,
          "format": "none",
          "label": "",
          "logBase": 1024,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 18,
        "y": 48
      },
      "id": 97,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": false,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "go_goroutines{job=\"istio-telemetry\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Number of Goroutines",
          "refId": "A",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Goroutines",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": "",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    }
  ],
  "refresh": "10s",
  "schemaVersion": 18,
  "style": "dark",
  "tags": [],
  "templating": {
    "list": []
  },
  "time": {
    "from": "now-5m",
    "to": "now"
  },
  "timepicker": {
    "refresh_intervals": [
      "5s",
      "10s",
      "30s",
      "1m",
      "5m",
      "15m",
      "30m",
      "1h",
      "2h",
      "1d"
    ],
    "time_options": [
      "5m",
      "15m",
      "1h",
      "6h",
      "12h",
      "24h",
      "2d",
      "7d",
      "30d"
    ]
  },
  "timezone": "",
  "title": "Istio Performance Dashboard",
  "uid": "vu8e0VWZk",
  "version": 22
}
`)

func chartsIstioTelemetryGrafanaDashboardsIstioPerformanceDashboardJsonBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaDashboardsIstioPerformanceDashboardJson, nil
}

func chartsIstioTelemetryGrafanaDashboardsIstioPerformanceDashboardJson() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaDashboardsIstioPerformanceDashboardJsonBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/dashboards/istio-performance-dashboard.json", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaDashboardsIstioServiceDashboardJson = []byte(`{
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "type": "dashboard"
      }
    ]
  },
  "editable": false,
  "gnetId": null,
  "graphTooltip": 0,
  "iteration": 1536442501501,
  "links": [],
  "panels": [
    {
      "content": "<div class=\"dashboard-header text-center\">\n<span>SERVICE: $service</span>\n</div>",
      "gridPos": {
        "h": 3,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "id": 89,
      "links": [],
      "mode": "html",
      "title": "",
      "transparent": true,
      "type": "text"
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "rgba(245, 54, 54, 0.9)",
        "rgba(237, 129, 40, 0.89)",
        "rgba(50, 172, 45, 0.97)"
      ],
      "datasource": "Prometheus",
      "format": "ops",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": true
      },
      "gridPos": {
        "h": 4,
        "w": 6,
        "x": 0,
        "y": 3
      },
      "id": 12,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": true,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "round(sum(irate(istio_requests_total{reporter=\"source\",destination_service=~\"$service\"}[5m])), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "A",
          "step": 4
        }
      ],
      "thresholds": "",
      "title": "Client Request Volume",
      "transparent": false,
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "current"
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "rgba(50, 172, 45, 0.97)",
        "rgba(237, 129, 40, 0.89)",
        "rgba(245, 54, 54, 0.9)"
      ],
      "datasource": "Prometheus",
      "decimals": null,
      "format": "percentunit",
      "gauge": {
        "maxValue": 100,
        "minValue": 80,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": false
      },
      "gridPos": {
        "h": 4,
        "w": 6,
        "x": 6,
        "y": 3
      },
      "id": 14,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": true,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "sum(irate(istio_requests_total{reporter=\"source\",destination_service=~\"$service\",response_code!~\"5.*\"}[5m])) / sum(irate(istio_requests_total{reporter=\"source\",destination_service=~\"$service\"}[5m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "B"
        }
      ],
      "thresholds": "95, 99, 99.5",
      "title": "Client Success Rate (non-5xx responses)",
      "transparent": false,
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "avg"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 4,
        "w": 6,
        "x": 12,
        "y": 3
      },
      "id": 87,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "hideEmpty": false,
        "hideZero": false,
        "max": false,
        "min": false,
        "rightSide": true,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "(histogram_quantile(0.50, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\",destination_service=~\"$service\"}[1m])) by (le)) / 1000) or histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\",destination_service=~\"$service\"}[1m])) by (le))",
          "format": "time_series",
          "interval": "",
          "intervalFactor": 1,
          "legendFormat": "P50",
          "refId": "A"
        },
        {
          "expr": "(histogram_quantile(0.90, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\",destination_service=~\"$service\"}[1m])) by (le)) / 1000) or histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\",destination_service=~\"$service\"}[1m])) by (le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "P90",
          "refId": "B"
        },
        {
          "expr": "(histogram_quantile(0.99, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\",destination_service=~\"$service\"}[1m])) by (le)) / 1000) or histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\",destination_service=~\"$service\"}[1m])) by (le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "P99",
          "refId": "C"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Client Request Duration",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "s",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "#299c46",
        "rgba(237, 129, 40, 0.89)",
        "#d44a3a"
      ],
      "datasource": "Prometheus",
      "format": "Bps",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": true
      },
      "gridPos": {
        "h": 4,
        "w": 6,
        "x": 18,
        "y": 3
      },
      "id": 84,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": true,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "sum(irate(istio_tcp_received_bytes_total{reporter=\"source\", destination_service=~\"$service\"}[1m]))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "",
          "refId": "A"
        }
      ],
      "thresholds": "",
      "title": "TCP Received Bytes",
      "transparent": false,
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "avg"
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "rgba(245, 54, 54, 0.9)",
        "rgba(237, 129, 40, 0.89)",
        "rgba(50, 172, 45, 0.97)"
      ],
      "datasource": "Prometheus",
      "format": "ops",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": true
      },
      "gridPos": {
        "h": 4,
        "w": 6,
        "x": 0,
        "y": 7
      },
      "id": 97,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": true,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "round(sum(irate(istio_requests_total{reporter=\"destination\",destination_service=~\"$service\"}[5m])), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "A",
          "step": 4
        }
      ],
      "thresholds": "",
      "title": "Server Request Volume",
      "transparent": false,
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "current"
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "rgba(50, 172, 45, 0.97)",
        "rgba(237, 129, 40, 0.89)",
        "rgba(245, 54, 54, 0.9)"
      ],
      "datasource": "Prometheus",
      "decimals": null,
      "format": "percentunit",
      "gauge": {
        "maxValue": 100,
        "minValue": 80,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": false
      },
      "gridPos": {
        "h": 4,
        "w": 6,
        "x": 6,
        "y": 7
      },
      "id": 98,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": true,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "sum(irate(istio_requests_total{reporter=\"destination\",destination_service=~\"$service\",response_code!~\"5.*\"}[5m])) / sum(irate(istio_requests_total{reporter=\"destination\",destination_service=~\"$service\"}[5m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "B"
        }
      ],
      "thresholds": "95, 99, 99.5",
      "title": "Server Success Rate (non-5xx responses)",
      "transparent": false,
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "avg"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 4,
        "w": 6,
        "x": 12,
        "y": 7
      },
      "id": 99,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "hideEmpty": false,
        "hideZero": false,
        "max": false,
        "min": false,
        "rightSide": true,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "(histogram_quantile(0.50, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\",destination_service=~\"$service\"}[1m])) by (le)) / 1000) or histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\",destination_service=~\"$service\"}[1m])) by (le))",
          "format": "time_series",
          "interval": "",
          "intervalFactor": 1,
          "legendFormat": "P50",
          "refId": "A"
        },
        {
          "expr": "(histogram_quantile(0.90, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\",destination_service=~\"$service\"}[1m])) by (le)) / 1000) or histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\",destination_service=~\"$service\"}[1m])) by (le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "P90",
          "refId": "B"
        },
        {
          "expr": "(histogram_quantile(0.99, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\",destination_service=~\"$service\"}[1m])) by (le)) / 1000) or histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\",destination_service=~\"$service\"}[1m])) by (le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "P99",
          "refId": "C"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Server Request Duration",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "s",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "#299c46",
        "rgba(237, 129, 40, 0.89)",
        "#d44a3a"
      ],
      "datasource": "Prometheus",
      "format": "Bps",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": true
      },
      "gridPos": {
        "h": 4,
        "w": 6,
        "x": 18,
        "y": 7
      },
      "id": 100,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": true,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "sum(irate(istio_tcp_sent_bytes_total{reporter=\"source\", destination_service=~\"$service\"}[1m])) ",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "",
          "refId": "A"
        }
      ],
      "thresholds": "",
      "title": "TCP Sent Bytes",
      "transparent": false,
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "avg"
    },
    {
      "content": "<div class=\"dashboard-header text-center\">\n<span>CLIENT WORKLOADS</span>\n</div>",
      "gridPos": {
        "h": 3,
        "w": 24,
        "x": 0,
        "y": 11
      },
      "id": 45,
      "links": [],
      "mode": "html",
      "title": "",
      "transparent": true,
      "type": "text"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 0,
      "gridPos": {
        "h": 6,
        "w": 12,
        "x": 0,
        "y": 14
      },
      "id": 25,
      "legend": {
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null as zero",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "round(sum(irate(istio_requests_total{connection_security_policy=\"mutual_tls\",destination_service=~\"$service\",reporter=\"source\",source_workload=~\"$srcwl\",source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace, response_code), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ source_workload }}.{{ source_workload_namespace }} : {{ response_code }} (🔐mTLS)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "round(sum(irate(istio_requests_total{connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", reporter=\"source\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace, response_code), 0.001)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ source_workload }}.{{ source_workload_namespace }} : {{ response_code }}",
          "refId": "A",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Incoming Requests by Source And Response Code",
      "tooltip": {
        "shared": false,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": [
          "total"
        ]
      },
      "yaxes": [
        {
          "format": "ops",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 12,
        "x": 12,
        "y": 14
      },
      "id": 26,
      "legend": {
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "hideZero": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(irate(istio_requests_total{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\",response_code!~\"5.*\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace) / sum(irate(istio_requests_total{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ source_workload }}.{{ source_workload_namespace }} (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "sum(irate(istio_requests_total{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\",response_code!~\"5.*\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace) / sum(irate(istio_requests_total{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ source_workload }}.{{ source_workload_namespace }}",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Incoming Success Rate (non-5xx responses) By Source",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "percentunit",
          "label": null,
          "logBase": 1,
          "max": "1.01",
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "description": "",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 0,
        "y": 20
      },
      "id": 27,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "hideZero": false,
        "max": false,
        "min": false,
        "rightSide": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "(histogram_quantile(0.50, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le)) / 1000) or histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50 (🔐mTLS)",
          "refId": "D",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.90, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le)) / 1000) or histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90 (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.95, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le)) / 1000) or histogram_quantile(0.95, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95 (🔐mTLS)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.99, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le)) / 1000) or histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99 (🔐mTLS)",
          "refId": "C",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.50, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le)) / 1000) or histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50",
          "refId": "E",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.90, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le)) / 1000) or histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90",
          "refId": "F",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.95, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le)) / 1000) or histogram_quantile(0.95, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95",
          "refId": "G",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.99, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le)) / 1000) or histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99",
          "refId": "H",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Incoming Request Duration by Source",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "s",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 8,
        "y": 20
      },
      "id": 28,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "max": false,
        "min": false,
        "rightSide": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "histogram_quantile(0.50, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50 (🔐mTLS)",
          "refId": "D",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.90, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}}  P90 (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.95, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95 (🔐mTLS)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.99, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}}  P99 (🔐mTLS)",
          "refId": "C",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.50, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50",
          "refId": "E",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.90, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90",
          "refId": "F",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.95, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95",
          "refId": "G",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.99, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99",
          "refId": "H",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Incoming Request Size By Source",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "decbytes",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 16,
        "y": 20
      },
      "id": 68,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "max": false,
        "min": false,
        "rightSide": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "histogram_quantile(0.50, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50 (🔐mTLS)",
          "refId": "D",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.90, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}}  P90 (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.95, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95 (🔐mTLS)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.99, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}}  P99 (🔐mTLS)",
          "refId": "C",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.50, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50",
          "refId": "E",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.90, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90",
          "refId": "F",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.95, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95",
          "refId": "G",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.99, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99",
          "refId": "H",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Response Size By Source",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "decbytes",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 12,
        "x": 0,
        "y": 26
      },
      "id": 80,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "round(sum(irate(istio_tcp_received_bytes_total{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace), 0.001)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ source_workload }}.{{ source_workload_namespace}} (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "round(sum(irate(istio_tcp_received_bytes_total{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ source_workload }}.{{ source_workload_namespace}}",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Bytes Received from Incoming TCP Connection",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "Bps",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 12,
        "x": 12,
        "y": 26
      },
      "id": 82,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "round(sum(irate(istio_tcp_sent_bytes_total{connection_security_policy=\"mutual_tls\", reporter=\"source\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ source_workload }}.{{ source_workload_namespace}} (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "round(sum(irate(istio_tcp_sent_bytes_total{connection_security_policy!=\"mutual_tls\", reporter=\"source\", destination_service=~\"$service\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ source_workload }}.{{ source_workload_namespace}}",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Bytes Sent to Incoming TCP Connection",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "Bps",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "content": "<div class=\"dashboard-header text-center\">\n<span>SERVICE WORKLOADS</span>\n</div>",
      "gridPos": {
        "h": 3,
        "w": 24,
        "x": 0,
        "y": 32
      },
      "id": 69,
      "links": [],
      "mode": "html",
      "title": "",
      "transparent": true,
      "type": "text"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 0,
      "gridPos": {
        "h": 6,
        "w": 12,
        "x": 0,
        "y": 35
      },
      "id": 90,
      "legend": {
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null as zero",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "round(sum(irate(istio_requests_total{connection_security_policy=\"mutual_tls\",destination_service=~\"$service\",reporter=\"destination\",destination_workload=~\"$dstwl\",destination_workload_namespace=~\"$dstns\"}[5m])) by (destination_workload, destination_workload_namespace, response_code), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} : {{ response_code }} (🔐mTLS)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "round(sum(irate(istio_requests_total{connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", reporter=\"destination\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[5m])) by (destination_workload, destination_workload_namespace, response_code), 0.001)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} : {{ response_code }}",
          "refId": "A",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Incoming Requests by Destination And Response Code",
      "tooltip": {
        "shared": false,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": [
          "total"
        ]
      },
      "yaxes": [
        {
          "format": "ops",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 12,
        "x": 12,
        "y": 35
      },
      "id": 91,
      "legend": {
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "hideZero": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(irate(istio_requests_total{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\",response_code!~\"5.*\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[5m])) by (destination_workload, destination_workload_namespace) / sum(irate(istio_requests_total{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[5m])) by (destination_workload, destination_workload_namespace)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "sum(irate(istio_requests_total{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\",response_code!~\"5.*\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[5m])) by (destination_workload, destination_workload_namespace) / sum(irate(istio_requests_total{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[5m])) by (destination_workload, destination_workload_namespace)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }}",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Incoming Success Rate (non-5xx responses) By Source",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "percentunit",
          "label": null,
          "logBase": 1,
          "max": "1.01",
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "description": "",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 0,
        "y": 41
      },
      "id": 94,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "hideZero": false,
        "max": false,
        "min": false,
        "rightSide": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "(histogram_quantile(0.50, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le)) / 1000) or histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P50 (🔐mTLS)",
          "refId": "D",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.90, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le)) / 1000) or histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P90 (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.95, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le)) / 1000) or histogram_quantile(0.95, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P95 (🔐mTLS)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.99, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le)) / 1000) or histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P99 (🔐mTLS)",
          "refId": "C",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.50, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le)) / 1000) or histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P50",
          "refId": "E",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.90, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le)) / 1000) or histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P90",
          "refId": "F",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.95, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le)) / 1000) or histogram_quantile(0.95, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P95",
          "refId": "G",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.99, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le)) / 1000) or histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P99",
          "refId": "H",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Incoming Request Duration by Source",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "s",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 8,
        "y": 41
      },
      "id": 95,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "max": false,
        "min": false,
        "rightSide": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "histogram_quantile(0.50, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P50 (🔐mTLS)",
          "refId": "D",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.90, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }}  P90 (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.95, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P95 (🔐mTLS)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.99, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }}  P99 (🔐mTLS)",
          "refId": "C",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.50, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P50",
          "refId": "E",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.90, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P90",
          "refId": "F",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.95, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P95",
          "refId": "G",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.99, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P99",
          "refId": "H",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Incoming Request Size By Source",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "decbytes",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 16,
        "y": 41
      },
      "id": 96,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "max": false,
        "min": false,
        "rightSide": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "histogram_quantile(0.50, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P50 (🔐mTLS)",
          "refId": "D",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.90, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }}  P90 (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.95, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P95 (🔐mTLS)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.99, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }}  P99 (🔐mTLS)",
          "refId": "C",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.50, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P50",
          "refId": "E",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.90, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P90",
          "refId": "F",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.95, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P95",
          "refId": "G",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.99, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} P99",
          "refId": "H",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Response Size By Source",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "decbytes",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 12,
        "x": 0,
        "y": 47
      },
      "id": 92,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "round(sum(irate(istio_tcp_received_bytes_total{reporter=\"source\", connection_security_policy=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace), 0.001)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace}} (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "round(sum(irate(istio_tcp_received_bytes_total{reporter=\"source\", connection_security_policy!=\"mutual_tls\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace}}",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Bytes Received from Incoming TCP Connection",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "Bps",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 12,
        "x": 12,
        "y": 47
      },
      "id": 93,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "round(sum(irate(istio_tcp_sent_bytes_total{connection_security_policy=\"mutual_tls\", reporter=\"source\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{destination_workload_namespace }} (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "round(sum(irate(istio_tcp_sent_bytes_total{connection_security_policy!=\"mutual_tls\", reporter=\"source\", destination_service=~\"$service\", destination_workload=~\"$dstwl\", destination_workload_namespace=~\"$dstns\"}[1m])) by (destination_workload, destination_workload_namespace), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{destination_workload_namespace }}",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Bytes Sent to Incoming TCP Connection",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "Bps",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    }
  ],
  "refresh": "10s",
  "schemaVersion": 16,
  "style": "dark",
  "tags": [],
  "templating": {
    "list": [
      {
        "allValue": null,
        "datasource": "Prometheus",
        "hide": 0,
        "includeAll": false,
        "label": "Service",
        "multi": false,
        "name": "service",
        "options": [],
        "query": "label_values(destination_service)",
        "refresh": 1,
        "regex": "",
        "sort": 0,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {
          "text": "All",
          "value": "$__all"
        },
        "datasource": "Prometheus",
        "hide": 0,
        "includeAll": true,
        "label": "Client Workload Namespace",
        "multi": true,
        "name": "srcns",
        "options": [],
        "query": "query_result( sum(istio_requests_total{reporter=\"destination\", destination_service=\"$service\"}) by (source_workload_namespace) or sum(istio_tcp_sent_bytes_total{reporter=\"destination\", destination_service=~\"$service\"}) by (source_workload_namespace))",
        "refresh": 1,
        "regex": "/.*namespace=\"([^\"]*).*/",
        "sort": 2,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {
          "text": "All",
          "value": "$__all"
        },
        "datasource": "Prometheus",
        "hide": 0,
        "includeAll": true,
        "label": "Client Workload",
        "multi": true,
        "name": "srcwl",
        "options": [],
        "query": "query_result( sum(istio_requests_total{reporter=\"destination\", destination_service=~\"$service\", source_workload_namespace=~\"$srcns\"}) by (source_workload) or sum(istio_tcp_sent_bytes_total{reporter=\"destination\", destination_service=~\"$service\", source_workload_namespace=~\"$srcns\"}) by (source_workload))",
        "refresh": 1,
        "regex": "/.*workload=\"([^\"]*).*/",
        "sort": 3,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {
          "text": "All",
          "value": "$__all"
        },
        "datasource": "Prometheus",
        "hide": 0,
        "includeAll": true,
        "label": "Service Workload Namespace",
        "multi": true,
        "name": "dstns",
        "options": [],
        "query": "query_result( sum(istio_requests_total{reporter=\"destination\", destination_service=\"$service\"}) by (destination_workload_namespace) or sum(istio_tcp_sent_bytes_total{reporter=\"destination\", destination_service=~\"$service\"}) by (destination_workload_namespace))",
        "refresh": 1,
        "regex": "/.*namespace=\"([^\"]*).*/",
        "sort": 2,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {
          "text": "All",
          "value": "$__all"
        },
        "datasource": "Prometheus",
        "hide": 0,
        "includeAll": true,
        "label": "Service Workload",
        "multi": true,
        "name": "dstwl",
        "options": [],
        "query": "query_result( sum(istio_requests_total{reporter=\"destination\", destination_service=~\"$service\", destination_workload_namespace=~\"$dstns\"}) by (destination_workload) or sum(istio_tcp_sent_bytes_total{reporter=\"destination\", destination_service=~\"$service\", destination_workload_namespace=~\"$dstns\"}) by (destination_workload))",
        "refresh": 1,
        "regex": "/.*workload=\"([^\"]*).*/",
        "sort": 3,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      }
    ]
  },
  "time": {
    "from": "now-5m",
    "to": "now"
  },
  "timepicker": {
    "refresh_intervals": [
      "5s",
      "10s",
      "30s",
      "1m",
      "5m",
      "15m",
      "30m",
      "1h",
      "2h",
      "1d"
    ],
    "time_options": [
      "5m",
      "15m",
      "1h",
      "6h",
      "12h",
      "24h",
      "2d",
      "7d",
      "30d"
    ]
  },
  "timezone": "",
  "title": "Istio Service Dashboard",
  "uid": "LJ_uJAvmk",
  "version": 1
}
`)

func chartsIstioTelemetryGrafanaDashboardsIstioServiceDashboardJsonBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaDashboardsIstioServiceDashboardJson, nil
}

func chartsIstioTelemetryGrafanaDashboardsIstioServiceDashboardJson() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaDashboardsIstioServiceDashboardJsonBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/dashboards/istio-service-dashboard.json", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaDashboardsIstioWorkloadDashboardJson = []byte(`{
  "__inputs": [
    {
      "name": "DS_PROMETHEUS",
      "label": "Prometheus",
      "description": "",
      "type": "datasource",
      "pluginId": "prometheus",
      "pluginName": "Prometheus"
    }
  ],
  "__requires": [
    {
      "type": "grafana",
      "id": "grafana",
      "name": "Grafana",
      "version": "5.0.4"
    },
    {
      "type": "panel",
      "id": "graph",
      "name": "Graph",
      "version": "5.0.0"
    },
    {
      "type": "datasource",
      "id": "prometheus",
      "name": "Prometheus",
      "version": "5.0.0"
    },
    {
      "type": "panel",
      "id": "singlestat",
      "name": "Singlestat",
      "version": "5.0.0"
    },
    {
      "type": "panel",
      "id": "text",
      "name": "Text",
      "version": "5.0.0"
    }
  ],
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "type": "dashboard"
      }
    ]
  },
  "editable": false,
  "gnetId": null,
  "graphTooltip": 0,
  "id": null,
  "iteration": 1531345461465,
  "links": [],
  "panels": [
    {
      "content": "<div class=\"dashboard-header text-center\">\n<span>WORKLOAD: $workload.$namespace</span>\n</div>",
      "gridPos": {
        "h": 3,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "id": 89,
      "links": [],
      "mode": "html",
      "title": "",
      "transparent": true,
      "type": "text"
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "rgba(245, 54, 54, 0.9)",
        "rgba(237, 129, 40, 0.89)",
        "rgba(50, 172, 45, 0.97)"
      ],
      "datasource": "Prometheus",
      "format": "ops",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": true
      },
      "gridPos": {
        "h": 4,
        "w": 8,
        "x": 0,
        "y": 3
      },
      "id": 12,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": true,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "round(sum(irate(istio_requests_total{reporter=\"destination\",destination_workload_namespace=~\"$namespace\",destination_workload=~\"$workload\"}[5m])), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "A",
          "step": 4
        }
      ],
      "thresholds": "",
      "title": "Incoming Request Volume",
      "transparent": false,
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "current"
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "rgba(50, 172, 45, 0.97)",
        "rgba(237, 129, 40, 0.89)",
        "rgba(245, 54, 54, 0.9)"
      ],
      "datasource": "Prometheus",
      "decimals": null,
      "format": "percentunit",
      "gauge": {
        "maxValue": 100,
        "minValue": 80,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": false
      },
      "gridPos": {
        "h": 4,
        "w": 8,
        "x": 8,
        "y": 3
      },
      "id": 14,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": true,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "sum(irate(istio_requests_total{reporter=\"destination\",destination_workload_namespace=~\"$namespace\",destination_workload=~\"$workload\",response_code!~\"5.*\"}[5m])) / sum(irate(istio_requests_total{reporter=\"destination\",destination_workload_namespace=~\"$namespace\",destination_workload=~\"$workload\"}[5m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "B"
        }
      ],
      "thresholds": "95, 99, 99.5",
      "title": "Incoming Success Rate (non-5xx responses)",
      "transparent": false,
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "avg"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 4,
        "w": 8,
        "x": 16,
        "y": 3
      },
      "id": 87,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "hideEmpty": false,
        "hideZero": false,
        "max": false,
        "min": false,
        "rightSide": true,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "(histogram_quantile(0.50, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\",destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\"}[1m])) by (le)) / 1000) or histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\",destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\"}[1m])) by (le))",
          "format": "time_series",
          "interval": "",
          "intervalFactor": 1,
          "legendFormat": "P50",
          "refId": "A"
        },
        {
          "expr": "(histogram_quantile(0.50, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\",destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\"}[1m])) by (le)) / 1000) or histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\",destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\"}[1m])) by (le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "P90",
          "refId": "B"
        },
        {
          "expr": "(histogram_quantile(0.50, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\",destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\"}[1m])) by (le)) / 1000) or histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\",destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\"}[1m])) by (le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "P99",
          "refId": "C"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Request Duration",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "s",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ]
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "#299c46",
        "rgba(237, 129, 40, 0.89)",
        "#d44a3a"
      ],
      "datasource": "Prometheus",
      "format": "Bps",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": true
      },
      "gridPos": {
        "h": 4,
        "w": 12,
        "x": 0,
        "y": 7
      },
      "id": 84,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": true,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "sum(irate(istio_tcp_sent_bytes_total{reporter=\"destination\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\"}[1m])) + sum(irate(istio_tcp_received_bytes_total{reporter=\"destination\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\"}[1m]))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "",
          "refId": "A"
        }
      ],
      "thresholds": "",
      "title": "TCP Server Traffic",
      "transparent": false,
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "avg"
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
      "colors": [
        "#299c46",
        "rgba(237, 129, 40, 0.89)",
        "#d44a3a"
      ],
      "datasource": "Prometheus",
      "format": "Bps",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": true
      },
      "gridPos": {
        "h": 4,
        "w": 12,
        "x": 12,
        "y": 7
      },
      "id": 85,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "nullPointMode": "connected",
      "nullText": null,
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": true,
        "lineColor": "rgb(31, 120, 193)",
        "show": true
      },
      "tableColumn": "",
      "targets": [
        {
          "expr": "sum(irate(istio_tcp_sent_bytes_total{reporter=\"source\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\"}[1m])) + sum(irate(istio_tcp_received_bytes_total{reporter=\"source\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\"}[1m]))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "",
          "refId": "A"
        }
      ],
      "thresholds": "",
      "title": "TCP Client Traffic",
      "transparent": false,
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "avg"
    },
    {
      "content": "<div class=\"dashboard-header text-center\">\n<span>INBOUND WORKLOADS</span>\n</div>",
      "gridPos": {
        "h": 3,
        "w": 24,
        "x": 0,
        "y": 11
      },
      "id": 45,
      "links": [],
      "mode": "html",
      "title": "",
      "transparent": true,
      "type": "text"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 0,
      "gridPos": {
        "h": 6,
        "w": 12,
        "x": 0,
        "y": 14
      },
      "id": 25,
      "legend": {
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null as zero",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "round(sum(irate(istio_requests_total{connection_security_policy=\"mutual_tls\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\", reporter=\"destination\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace, response_code), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ source_workload }}.{{ source_workload_namespace }} : {{ response_code }} (🔐mTLS)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "round(sum(irate(istio_requests_total{connection_security_policy!=\"mutual_tls\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\", reporter=\"destination\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace, response_code), 0.001)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ source_workload }}.{{ source_workload_namespace }} : {{ response_code }}",
          "refId": "A",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Incoming Requests by Source And Response Code",
      "tooltip": {
        "shared": false,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": [
          "total"
        ]
      },
      "yaxes": [
        {
          "format": "ops",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ]
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 12,
        "x": 12,
        "y": 14
      },
      "id": 26,
      "legend": {
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "hideZero": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(irate(istio_requests_total{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\",response_code!~\"5.*\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace) / sum(irate(istio_requests_total{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ source_workload }}.{{ source_workload_namespace }} (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "sum(irate(istio_requests_total{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\",response_code!~\"5.*\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace) / sum(irate(istio_requests_total{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[5m])) by (source_workload, source_workload_namespace)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ source_workload }}.{{ source_workload_namespace }}",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Incoming Success Rate (non-5xx responses) By Source",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "percentunit",
          "label": null,
          "logBase": 1,
          "max": "1.01",
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ]
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "description": "",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 0,
        "y": 20
      },
      "id": 27,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "hideZero": false,
        "max": false,
        "min": false,
        "rightSide": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "(histogram_quantile(0.50, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le)) / 1000) or histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50 (🔐mTLS)",
          "refId": "D",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.90, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le)) / 1000) or histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90 (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.95, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le)) / 1000) or histogram_quantile(0.95, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95 (🔐mTLS)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.99, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le)) / 1000) or histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99 (🔐mTLS)",
          "refId": "C",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.50, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le)) / 1000) or histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50",
          "refId": "E",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.90, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le)) / 1000) or histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90",
          "refId": "F",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.95, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le)) / 1000) or histogram_quantile(0.95, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95",
          "refId": "G",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.99, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le)) / 1000) or histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99",
          "refId": "H",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Incoming Request Duration by Source",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "s",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ]
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 8,
        "y": 20
      },
      "id": 28,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "max": false,
        "min": false,
        "rightSide": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "histogram_quantile(0.50, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50 (🔐mTLS)",
          "refId": "D",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.90, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}}  P90 (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.95, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95 (🔐mTLS)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.99, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}}  P99 (🔐mTLS)",
          "refId": "C",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.50, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50",
          "refId": "E",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.90, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90",
          "refId": "F",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.95, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95",
          "refId": "G",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.99, sum(irate(istio_request_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99",
          "refId": "H",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Incoming Request Size By Source",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "decbytes",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ]
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 16,
        "y": 20
      },
      "id": 68,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "max": false,
        "min": false,
        "rightSide": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "histogram_quantile(0.50, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50 (🔐mTLS)",
          "refId": "D",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.90, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}}  P90 (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.95, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95 (🔐mTLS)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.99, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}}  P99 (🔐mTLS)",
          "refId": "C",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.50, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P50",
          "refId": "E",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.90, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P90",
          "refId": "F",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.95, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P95",
          "refId": "G",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.99, sum(irate(istio_response_bytes_bucket{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload=~\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{source_workload}}.{{source_workload_namespace}} P99",
          "refId": "H",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Response Size By Source",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "decbytes",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ]
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 12,
        "x": 0,
        "y": 26
      },
      "id": 80,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "round(sum(irate(istio_tcp_received_bytes_total{reporter=\"destination\", connection_security_policy=\"mutual_tls\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace), 0.001)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ source_workload }}.{{ source_workload_namespace}} (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "round(sum(irate(istio_tcp_received_bytes_total{reporter=\"destination\", connection_security_policy!=\"mutual_tls\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ source_workload }}.{{ source_workload_namespace}}",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Bytes Received from Incoming TCP Connection",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "Bps",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ]
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 12,
        "x": 12,
        "y": 26
      },
      "id": 82,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "round(sum(irate(istio_tcp_sent_bytes_total{connection_security_policy=\"mutual_tls\", reporter=\"destination\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ source_workload }}.{{ source_workload_namespace}} (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "round(sum(irate(istio_tcp_sent_bytes_total{connection_security_policy!=\"mutual_tls\", reporter=\"destination\", destination_workload_namespace=~\"$namespace\", destination_workload=~\"$workload\", source_workload=~\"$srcwl\", source_workload_namespace=~\"$srcns\"}[1m])) by (source_workload, source_workload_namespace), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ source_workload }}.{{ source_workload_namespace}}",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Bytes Sent to Incoming TCP Connection",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "Bps",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ]
    },
    {
      "content": "<div class=\"dashboard-header text-center\">\n<span>OUTBOUND SERVICES</span>\n</div>",
      "gridPos": {
        "h": 3,
        "w": 24,
        "x": 0,
        "y": 32
      },
      "id": 69,
      "links": [],
      "mode": "html",
      "title": "",
      "transparent": true,
      "type": "text"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 0,
      "gridPos": {
        "h": 6,
        "w": 12,
        "x": 0,
        "y": 35
      },
      "id": 70,
      "legend": {
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null as zero",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "round(sum(irate(istio_requests_total{connection_security_policy=\"mutual_tls\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\", reporter=\"source\", destination_service=~\"$dstsvc\"}[5m])) by (destination_service, response_code), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} : {{ response_code }} (🔐mTLS)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "round(sum(irate(istio_requests_total{connection_security_policy!=\"mutual_tls\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\", reporter=\"source\", destination_service=~\"$dstsvc\"}[5m])) by (destination_service, response_code), 0.001)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} : {{ response_code }}",
          "refId": "A",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Outgoing Requests by Destination And Response Code",
      "tooltip": {
        "shared": false,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": [
          "total"
        ]
      },
      "yaxes": [
        {
          "format": "ops",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ]
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 12,
        "x": 12,
        "y": 35
      },
      "id": 71,
      "legend": {
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "hideZero": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(irate(istio_requests_total{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\",response_code!~\"5.*\", destination_service=~\"$dstsvc\"}[5m])) by (destination_service) / sum(irate(istio_requests_total{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\", destination_service=~\"$dstsvc\"}[5m])) by (destination_service)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "sum(irate(istio_requests_total{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\",response_code!~\"5.*\", destination_service=~\"$dstsvc\"}[5m])) by (destination_service) / sum(irate(istio_requests_total{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\", destination_service=~\"$dstsvc\"}[5m])) by (destination_service)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{destination_service }}",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Outgoing Success Rate (non-5xx responses) By Destination",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "percentunit",
          "label": null,
          "logBase": 1,
          "max": "1.01",
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ]
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "description": "",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 0,
        "y": 41
      },
      "id": 72,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "hideZero": false,
        "max": false,
        "min": false,
        "rightSide": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "(histogram_quantile(0.50, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le)) / 1000) or histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P50 (🔐mTLS)",
          "refId": "D",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.90, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le)) / 1000) or histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P90 (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.95, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le)) / 1000) or histogram_quantile(0.95, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P95 (🔐mTLS)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.99, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le)) / 1000) or histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P99 (🔐mTLS)",
          "refId": "C",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.50, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le)) / 1000) or histogram_quantile(0.50, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P50",
          "refId": "E",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.90, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le)) / 1000) or histogram_quantile(0.90, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P90",
          "refId": "F",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.95, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le)) / 1000) or histogram_quantile(0.95, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P95",
          "refId": "G",
          "step": 2
        },
        {
          "expr": "(histogram_quantile(0.99, sum(irate(istio_request_duration_milliseconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le)) / 1000) or histogram_quantile(0.99, sum(irate(istio_request_duration_seconds_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P99",
          "refId": "H",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Outgoing Request Duration by Destination",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "s",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ]
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 8,
        "y": 41
      },
      "id": 73,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "max": false,
        "min": false,
        "rightSide": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "histogram_quantile(0.50, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P50 (🔐mTLS)",
          "refId": "D",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.90, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P90 (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.95, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P95 (🔐mTLS)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.99, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P99 (🔐mTLS)",
          "refId": "C",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.50, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P50",
          "refId": "E",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.90, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P90",
          "refId": "F",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.95, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P95",
          "refId": "G",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.99, sum(irate(istio_request_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P99",
          "refId": "H",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Outgoing Request Size By Destination",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "decbytes",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ]
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 8,
        "x": 16,
        "y": 41
      },
      "id": 74,
      "legend": {
        "alignAsTable": false,
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "max": false,
        "min": false,
        "rightSide": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "histogram_quantile(0.50, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P50 (🔐mTLS)",
          "refId": "D",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.90, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P90 (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.95, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P95 (🔐mTLS)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.99, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }}  P99 (🔐mTLS)",
          "refId": "C",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.50, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P50",
          "refId": "E",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.90, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P90",
          "refId": "F",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.95, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P95",
          "refId": "G",
          "step": 2
        },
        {
          "expr": "histogram_quantile(0.99, sum(irate(istio_response_bytes_bucket{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service, le))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} P99",
          "refId": "H",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Response Size By Destination",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "decbytes",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ]
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 12,
        "x": 0,
        "y": 47
      },
      "id": 76,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "round(sum(irate(istio_tcp_sent_bytes_total{connection_security_policy=\"mutual_tls\", reporter=\"source\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "round(sum(irate(istio_tcp_sent_bytes_total{connection_security_policy!=\"mutual_tls\", reporter=\"source\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }}",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Bytes Sent on Outgoing TCP Connection",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "Bps",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ]
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 12,
        "x": 12,
        "y": 47
      },
      "id": 78,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "round(sum(irate(istio_tcp_received_bytes_total{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }} (🔐mTLS)",
          "refId": "A",
          "step": 2
        },
        {
          "expr": "round(sum(irate(istio_tcp_received_bytes_total{reporter=\"source\", connection_security_policy!=\"mutual_tls\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\", destination_service=~\"$dstsvc\"}[1m])) by (destination_service), 0.001)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }}",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Bytes Received from Outgoing TCP Connection",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "Bps",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ]
    }
  ],
  "refresh": "10s",
  "schemaVersion": 16,
  "style": "dark",
  "tags": [],
  "templating": {
    "list": [
      {
        "allValue": null,
        "current": {},
        "datasource": "Prometheus",
        "hide": 0,
        "includeAll": false,
        "label": "Namespace",
        "multi": false,
        "name": "namespace",
        "options": [],
        "query": "query_result(sum(istio_requests_total) by (destination_workload_namespace) or sum(istio_tcp_sent_bytes_total) by (destination_workload_namespace))",
        "refresh": 1,
        "regex": "/.*_namespace=\"([^\"]*).*/",
        "sort": 0,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {},
        "datasource": "Prometheus",
        "hide": 0,
        "includeAll": false,
        "label": "Workload",
        "multi": false,
        "name": "workload",
        "options": [],
        "query": "query_result((sum(istio_requests_total{destination_workload_namespace=~\"$namespace\"}) by (destination_workload) or sum(istio_requests_total{source_workload_namespace=~\"$namespace\"}) by (source_workload)) or (sum(istio_tcp_sent_bytes_total{destination_workload_namespace=~\"$namespace\"}) by (destination_workload) or sum(istio_tcp_sent_bytes_total{source_workload_namespace=~\"$namespace\"}) by (source_workload)))",
        "refresh": 1,
        "regex": "/.*workload=\"([^\"]*).*/",
        "sort": 1,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {},
        "datasource": "Prometheus",
        "hide": 0,
        "includeAll": true,
        "label": "Inbound Workload Namespace",
        "multi": true,
        "name": "srcns",
        "options": [],
        "query": "query_result( sum(istio_requests_total{reporter=\"destination\", destination_workload=\"$workload\", destination_workload_namespace=~\"$namespace\"}) by (source_workload_namespace) or sum(istio_tcp_sent_bytes_total{reporter=\"destination\", destination_workload=\"$workload\", destination_workload_namespace=~\"$namespace\"}) by (source_workload_namespace))",
        "refresh": 1,
        "regex": "/.*namespace=\"([^\"]*).*/",
        "sort": 2,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {},
        "datasource": "Prometheus",
        "hide": 0,
        "includeAll": true,
        "label": "Inbound Workload",
        "multi": true,
        "name": "srcwl",
        "options": [],
        "query": "query_result( sum(istio_requests_total{reporter=\"destination\", destination_workload=\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload_namespace=~\"$srcns\"}) by (source_workload) or sum(istio_tcp_sent_bytes_total{reporter=\"destination\", destination_workload=\"$workload\", destination_workload_namespace=~\"$namespace\", source_workload_namespace=~\"$srcns\"}) by (source_workload))",
        "refresh": 1,
        "regex": "/.*workload=\"([^\"]*).*/",
        "sort": 3,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {},
        "datasource": "Prometheus",
        "hide": 0,
        "includeAll": true,
        "label": "Destination Service",
        "multi": true,
        "name": "dstsvc",
        "options": [],
        "query": "query_result( sum(istio_requests_total{reporter=\"source\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\"}) by (destination_service) or sum(istio_tcp_sent_bytes_total{reporter=\"source\", source_workload=~\"$workload\", source_workload_namespace=~\"$namespace\"}) by (destination_service))",
        "refresh": 1,
        "regex": "/.*destination_service=\"([^\"]*).*/",
        "sort": 4,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      }
    ]
  },
  "time": {
    "from": "now-5m",
    "to": "now"
  },
  "timepicker": {
    "refresh_intervals": [
      "5s",
      "10s",
      "30s",
      "1m",
      "5m",
      "15m",
      "30m",
      "1h",
      "2h",
      "1d"
    ],
    "time_options": [
      "5m",
      "15m",
      "1h",
      "6h",
      "12h",
      "24h",
      "2d",
      "7d",
      "30d"
    ]
  },
  "timezone": "",
  "title": "Istio Workload Dashboard",
  "uid": "UbsSZTDik",
  "version": 1
}
`)

func chartsIstioTelemetryGrafanaDashboardsIstioWorkloadDashboardJsonBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaDashboardsIstioWorkloadDashboardJson, nil
}

func chartsIstioTelemetryGrafanaDashboardsIstioWorkloadDashboardJson() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaDashboardsIstioWorkloadDashboardJsonBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/dashboards/istio-workload-dashboard.json", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaDashboardsMixerDashboardJson = []byte(`{
  "__inputs": [
    {
      "name": "DS_PROMETHEUS",
      "label": "Prometheus",
      "description": "",
      "type": "datasource",
      "pluginId": "prometheus",
      "pluginName": "Prometheus"
    }
  ],
  "__requires": [
    {
      "type": "grafana",
      "id": "grafana",
      "name": "Grafana",
      "version": "5.2.3"
    },
    {
      "type": "panel",
      "id": "graph",
      "name": "Graph",
      "version": "5.0.0"
    },
    {
      "type": "datasource",
      "id": "prometheus",
      "name": "Prometheus",
      "version": "5.0.0"
    },
    {
      "type": "panel",
      "id": "text",
      "name": "Text",
      "version": "5.0.0"
    }
  ],
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "limit": 100,
        "name": "Annotations & Alerts",
        "showIn": 0,
        "type": "dashboard"
      }
    ]
  },
  "editable": false,
  "gnetId": null,
  "graphTooltip": 1,
  "id": null,
  "iteration": 1543881232533,
  "links": [],
  "panels": [
    {
      "content": "<center><h2>Deployed Versions</h2></center>",
      "gridPos": {
        "h": 3,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "height": "40",
      "id": 62,
      "links": [],
      "mode": "html",
      "title": "",
      "transparent": true,
      "type": "text"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 5,
        "w": 24,
        "x": 0,
        "y": 3
      },
      "id": 64,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(istio_build{component=\"mixer\"}) by (tag)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ tag }}",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Mixer Versions",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "content": "<center><h2>Resource Usage</h2></center>",
      "gridPos": {
        "h": 3,
        "w": 24,
        "x": 0,
        "y": 8
      },
      "height": "40",
      "id": 29,
      "links": [],
      "mode": "html",
      "title": "",
      "transparent": true,
      "type": "text"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 0,
        "y": 11
      },
      "id": 5,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(process_virtual_memory_bytes{job=~\"istio-telemetry|istio-policy\"}) by (job)",
          "format": "time_series",
          "instant": false,
          "intervalFactor": 2,
          "legendFormat": "Virtual Memory ({{ job }})",
          "refId": "I"
        },
        {
          "expr": "sum(process_resident_memory_bytes{job=~\"istio-telemetry|istio-policy\"}) by (job)",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Resident Memory ({{ job }})",
          "refId": "H"
        },
        {
          "expr": "sum(go_memstats_heap_sys_bytes{job=~\"istio-telemetry|istio-policy\"}) by (job)",
          "format": "time_series",
          "hide": true,
          "intervalFactor": 2,
          "legendFormat": "heap sys ({{ job }})",
          "refId": "A"
        },
        {
          "expr": "sum(go_memstats_heap_alloc_bytes{job=~\"istio-telemetry|istio-policy\"}) by (job)",
          "format": "time_series",
          "hide": true,
          "intervalFactor": 2,
          "legendFormat": "heap alloc ({{ job }})",
          "refId": "D"
        },
        {
          "expr": "sum(go_memstats_alloc_bytes{job=~\"istio-telemetry|istio-policy\"}) by (job)",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Alloc ({{ job }})",
          "refId": "F"
        },
        {
          "expr": "sum(go_memstats_heap_inuse_bytes{job=~\"istio-telemetry|istio-policy\"}) by (job)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "Heap in-use ({{ job }})",
          "refId": "E"
        },
        {
          "expr": "sum(go_memstats_stack_inuse_bytes{job=~\"istio-telemetry|istio-policy\"}) by (job)",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Stack in-use ({{ job }})",
          "refId": "G"
        },
        {
          "expr": "sum(label_replace(container_memory_usage_bytes{job=\"kubernetes-cadvisor\", container=~\"mixer|istio-proxy\", pod=~\"istio-telemetry-.*|istio-policy-.*\"}, \"service\", \"$1\" , \"pod\", \"(istio-telemetry|istio-policy)-.*\")) by (service)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "{{ service }} total (k8s)",
          "refId": "C"
        },
        {
          "expr": "sum(label_replace(container_memory_usage_bytes{job=\"kubernetes-cadvisor\", container=~\"mixer|istio-proxy\", pod=~\"istio-telemetry-.*|istio-policy-.*\"}, \"service\", \"$1\" , \"pod\", \"(istio-telemetry|istio-policy)-.*\")) by (container, service)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "{{ service }} - {{ container }} (k8s)",
          "refId": "B"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Memory",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 6,
        "y": 11
      },
      "id": 6,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "label_replace(sum(rate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",container=~\"mixer|istio-proxy\", pod=~\"istio-telemetry-.*|istio-policy-.*\"}[1m])) by (pod), \"service\", \"$1\" , \"pod\", \"(istio-telemetry|istio-policy)-.*\")",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "{{ service }} total (k8s)",
          "refId": "A"
        },
        {
          "expr": "label_replace(sum(rate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",container=~\"mixer|istio-proxy\", pod=~\"istio-telemetry-.*|istio-policy-.*\"}[1m])) by (container, pod), \"service\", \"$1\" , \"pod\", \"(istio-telemetry|istio-policy)-.*\")",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "{{ service }} - {{ container }} (k8s)",
          "refId": "B"
        },
        {
          "expr": "sum(irate(process_cpu_seconds_total{job=~\"istio-telemetry|istio-policy\"}[1m])) by (job)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "{{ job }} (self-reported)",
          "refId": "C"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "CPU",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 12,
        "y": 11
      },
      "id": 7,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(process_open_fds{job=~\"istio-telemetry|istio-policy\"}) by (job)",
          "format": "time_series",
          "hide": true,
          "instant": false,
          "interval": "",
          "intervalFactor": 2,
          "legendFormat": "Open FDs ({{ job }})",
          "refId": "A"
        },
        {
          "expr": "sum(label_replace(container_fs_usage_bytes{job=\"kubernetes-cadvisor\", container=~\"mixer|istio-proxy\", pod=~\"istio-telemetry-.*|istio-policy-.*\"}, \"service\", \"$1\" , \"pod\", \"(istio-telemetry|istio-policy)-.*\")) by (container, service)",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "{{ service }} - {{ container }}",
          "refId": "B"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Disk",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "bytes",
          "label": "",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "decimals": null,
          "format": "none",
          "label": "",
          "logBase": 1024,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 18,
        "y": 11
      },
      "id": 4,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": false,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(go_goroutines{job=~\"istio-telemetry|istio-policy\"}) by (job)",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Number of Goroutines ({{ job }})",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Goroutines",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": "",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "content": "<center><h2>Mixer Overview</h2></center>",
      "gridPos": {
        "h": 3,
        "w": 24,
        "x": 0,
        "y": 18
      },
      "height": "40px",
      "id": 30,
      "links": [],
      "mode": "html",
      "title": "",
      "transparent": true,
      "type": "text"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 6,
        "x": 0,
        "y": 21
      },
      "id": 9,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(rate(grpc_io_server_completed_rpcs[1m]))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "mixer (Total)",
          "refId": "B"
        },
        {
          "expr": "sum(rate(grpc_io_server_completed_rpcs[1m])) by (grpc_server_method)",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "mixer ({{ grpc_server_method }})",
          "refId": "C"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Incoming Requests",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "ops",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 6,
        "x": 6,
        "y": 21
      },
      "id": 8,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [
        {
          "alias": "{}",
          "yaxis": 1
        }
      ],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "histogram_quantile(0.5, sum(rate(grpc_io_server_server_latency_bucket{}[1m])) by (grpc_server_method, le))",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "{{ grpc_server_method }} 0.5",
          "refId": "B"
        },
        {
          "expr": "histogram_quantile(0.9, sum(rate(grpc_io_server_server_latency_bucket{}[1m])) by (grpc_server_method, le))",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "{{ grpc_server_method }} 0.9",
          "refId": "C"
        },
        {
          "expr": "histogram_quantile(0.99, sum(rate(grpc_io_server_server_latency_bucket{}[1m])) by (grpc_server_method, le))",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "{{ grpc_server_method }} 0.99",
          "refId": "D"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Response Durations",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "ms",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 6,
        "x": 12,
        "y": 21
      },
      "id": 11,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(rate(grpc_server_handled_total{grpc_code=~\"Unknown|Unimplemented|Internal|DataLoss\"}[1m])) by (grpc_method)",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Mixer {{ grpc_method }}",
          "refId": "B"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Server Error Rate (5xx responses)",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 6,
        "w": 6,
        "x": 18,
        "y": 21
      },
      "id": 12,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(irate(grpc_server_handled_total{grpc_code!=\"OK\",grpc_service=~\".*Mixer\"}[1m])) by (grpc_method)",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Mixer {{ grpc_method }}",
          "refId": "B"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Non-successes (4xxs)",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "content": "<center><h2>Adapters and Config</h2></center>",
      "gridPos": {
        "h": 3,
        "w": 24,
        "x": 0,
        "y": 27
      },
      "id": 28,
      "links": [],
      "mode": "html",
      "title": "",
      "transparent": true,
      "type": "text"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 12,
        "x": 0,
        "y": 30
      },
      "id": 13,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(irate(mixer_runtime_dispatches_total{adapter=~\"$adapter\"}[1m])) by (adapter)",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "{{ adapter }}",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Adapter Dispatch Count",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 12,
        "x": 12,
        "y": 30
      },
      "id": 14,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "histogram_quantile(0.5, sum(irate(mixer_runtime_dispatch_duration_seconds_bucket{adapter=~\"$adapter\"}[1m])) by (adapter, le))",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "{{ adapter }} - p50",
          "refId": "A"
        },
        {
          "expr": "histogram_quantile(0.9, sum(irate(mixer_runtime_dispatch_duration_seconds_bucket{adapter=~\"$adapter\"}[1m])) by (adapter, le))",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "{{ adapter }} - p90 ",
          "refId": "B"
        },
        {
          "expr": "histogram_quantile(0.99, sum(irate(mixer_runtime_dispatch_duration_seconds_bucket{adapter=~\"$adapter\"}[1m])) by (adapter, le))",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "{{ adapter }} - p99",
          "refId": "C"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Adapter Dispatch Duration",
      "tooltip": {
        "shared": true,
        "sort": 1,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "s",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 0,
        "y": 37
      },
      "id": 60,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "scalar(topk(1, max(mixer_config_rule_config_count) by (configID)))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Rules",
          "refId": "A"
        },
        {
          "expr": "scalar(topk(1, max(mixer_config_rule_config_error_count) by (configID)))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Config Errors",
          "refId": "B"
        },
        {
          "expr": "scalar(topk(1, max(mixer_config_rule_config_match_error_count) by (configID)))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Match Errors",
          "refId": "C"
        },
        {
          "expr": "scalar(topk(1, max(mixer_config_unsatisfied_action_handler_count) by (configID)))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Unsatisfied Actions",
          "refId": "D"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Rules",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 6,
        "y": 37
      },
      "id": 56,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "scalar(topk(1, max(mixer_config_instance_config_count) by (configID)))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Instances",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Instances in Latest Config",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 12,
        "y": 37
      },
      "id": 54,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "scalar(topk(1, max(mixer_config_handler_config_count) by (configID)))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Handlers",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Handlers in Latest Config",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 18,
        "y": 37
      },
      "id": 58,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "scalar(topk(1, max(mixer_config_attribute_count) by (configID)))",
          "format": "time_series",
          "instant": false,
          "intervalFactor": 1,
          "legendFormat": "Attributes",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Attributes in Latest Config",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "content": "<center><h2>Individual Adapters</h2></center>",
      "gridPos": {
        "h": 3,
        "w": 24,
        "x": 0,
        "y": 44
      },
      "id": 23,
      "links": [],
      "mode": "html",
      "title": "",
      "transparent": true,
      "type": "text"
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 47
      },
      "id": 46,
      "panels": [],
      "repeat": "adapter",
      "title": "$adapter Adapter",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 12,
        "x": 0,
        "y": 48
      },
      "id": 17,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "label_replace(irate(mixer_runtime_dispatches_total{adapter=~\"$adapter\"}[1m]),\"handler\", \"$1 ($3)\", \"handler\", \"(.*)\\\\.(.*)\\\\.(.*)\")",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "{{ handler }} (error: {{  error }})",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Dispatch Count By Handler",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 12,
        "x": 12,
        "y": 48
      },
      "id": 18,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "label_replace(histogram_quantile(0.5, sum(rate(mixer_runtime_dispatch_duration_seconds_bucket{adapter=~\"$adapter\"}[1m])) by (handler, error, le)),  \"handler_short\", \"$1 ($3)\", \"handler\", \"(.*)\\\\.(.*)\\\\.(.*)\")",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "p50 - {{ handler_short }} (error: {{ error }})",
          "refId": "A"
        },
        {
          "expr": "label_replace(histogram_quantile(0.9, sum(irate(mixer_runtime_dispatch_duration_seconds_bucket{adapter=~\"$adapter\"}[1m])) by (handler, error, le)),  \"handler_short\", \"$1 ($3)\", \"handler\", \"(.*)\\\\.(.*)\\\\.(.*)\")",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "p90 - {{ handler_short }} (error: {{ error }})",
          "refId": "D"
        },
        {
          "expr": "label_replace(histogram_quantile(0.99, sum(irate(mixer_runtime_dispatch_duration_seconds_bucket{adapter=~\"$adapter\"}[1m])) by (handler, error, le)),  \"handler_short\", \"$1 ($3)\", \"handler\", \"(.*)\\\\.(.*)\\\\.(.*)\")",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "p99 - {{ handler_short }} (error: {{ error }})",
          "refId": "E"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeShift": null,
      "title": "Dispatch Duration By Handler",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "s",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    }
  ],
  "refresh": "5s",
  "schemaVersion": 16,
  "style": "dark",
  "tags": [],
  "templating": {
    "list": [
      {
        "allValue": null,
        "current": {},
        "datasource": "Prometheus",
        "hide": 0,
        "includeAll": true,
        "label": "Adapter",
        "multi": true,
        "name": "adapter",
        "options": [],
        "query": "label_values(adapter)",
        "refresh": 2,
        "regex": "",
        "sort": 1,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      }
    ]
  },
  "time": {
    "from": "now-5m",
    "to": "now"
  },
  "timepicker": {
    "refresh_intervals": [
      "5s",
      "10s",
      "30s",
      "1m",
      "5m",
      "15m",
      "30m",
      "1h",
      "2h",
      "1d"
    ],
    "time_options": [
      "5m",
      "15m",
      "1h",
      "6h",
      "12h",
      "24h",
      "2d",
      "7d",
      "30d"
    ]
  },
  "timezone": "",
  "title": "Istio Mixer Dashboard",
  "version": 4
}
`)

func chartsIstioTelemetryGrafanaDashboardsMixerDashboardJsonBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaDashboardsMixerDashboardJson, nil
}

func chartsIstioTelemetryGrafanaDashboardsMixerDashboardJson() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaDashboardsMixerDashboardJsonBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/dashboards/mixer-dashboard.json", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaDashboardsPilotDashboardJson = []byte(`{
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "type": "dashboard"
      }
    ]
  },
  "editable": false,
  "gnetId": null,
  "graphTooltip": 1,
  "id": 11,
  "links": [],
  "panels": [
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "id": 60,
      "panels": [],
      "title": "Deployed Versions",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 5,
        "w": 24,
        "x": 0,
        "y": 1
      },
      "id": 56,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(istio_build{component=\"pilot\"}) by (tag)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ tag }}",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Pilot Versions",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 6
      },
      "id": 62,
      "panels": [],
      "title": "Resource Usage",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 0,
        "y": 7
      },
      "id": 5,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "process_virtual_memory_bytes{job=\"pilot\"}",
          "format": "time_series",
          "instant": false,
          "intervalFactor": 2,
          "legendFormat": "Virtual Memory",
          "refId": "I",
          "step": 2
        },
        {
          "expr": "process_resident_memory_bytes{job=\"pilot\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Resident Memory",
          "refId": "H",
          "step": 2
        },
        {
          "expr": "go_memstats_heap_sys_bytes{job=\"pilot\"}",
          "format": "time_series",
          "hide": true,
          "intervalFactor": 2,
          "legendFormat": "heap sys",
          "refId": "A"
        },
        {
          "expr": "go_memstats_heap_alloc_bytes{job=\"pilot\"}",
          "format": "time_series",
          "hide": true,
          "intervalFactor": 2,
          "legendFormat": "heap alloc",
          "refId": "D"
        },
        {
          "expr": "go_memstats_alloc_bytes{job=\"pilot\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Alloc",
          "refId": "F",
          "step": 2
        },
        {
          "expr": "go_memstats_heap_inuse_bytes{job=\"pilot\"}",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "Heap in-use",
          "refId": "E",
          "step": 2
        },
        {
          "expr": "go_memstats_stack_inuse_bytes{job=\"pilot\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Stack in-use",
          "refId": "G",
          "step": 2
        },
        {
          "expr": "container_memory_usage_bytes{job=\"kubernetes-cadvisor\", container=~\"discovery\", pod=~\"istiod-.*|istio-pilot-.*\"}",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "Discovery (container)",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "container_memory_usage_bytes{job=\"kubernetes-cadvisor\", container=~\"istio-proxy\", pod=~\"istiod-.*|istio-pilot-.*\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Sidecar (container)",
          "refId": "C"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Memory",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "bytes",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 6,
        "y": 7
      },
      "id": 6,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(irate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",container=\"discovery\", pod=~\"istiod-.*|istio-pilot-.*\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Discovery (container)",
          "refId": "A"
        },
        {
          "expr": "irate(process_cpu_seconds_total{job=\"pilot\"}[1m])",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "Discovery (process)",
          "refId": "C",
          "step": 2
        },
        {
          "expr": "sum(irate(container_cpu_usage_seconds_total{job=\"kubernetes-cadvisor\",container=\"istio-proxy\", pod=~\"istiod-.*|istio-pilot-.*\"}[1m]))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "Sidecar (container)",
          "refId": "B",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "CPU",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 12,
        "y": 7
      },
      "id": 7,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "container_fs_usage_bytes{job=\"kubernetes-cadvisor\", container=\"discovery\", pod=~\"istiod-.*|istio-pilot-.*\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Discovery",
          "refId": "B",
          "step": 2
        },
        {
          "expr": "container_fs_usage_bytes{job=\"kubernetes-cadvisor\", container=\"istio-proxy\", pod=~\"istiod-.*|istio-pilot-.*\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Sidecar",
          "refId": "A"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Disk",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "bytes",
          "label": "",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "decimals": null,
          "format": "none",
          "label": "",
          "logBase": 1024,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 18,
        "y": 7
      },
      "id": 4,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": false,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "go_goroutines{job=\"pilot\"}",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "Number of Goroutines",
          "refId": "A",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Goroutines",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": "",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 14
      },
      "id": 58,
      "panels": [],
      "title": "Pilot Push Information",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": true,
      "dashLength": 10,
      "dashes": false,
      "description": "Shows the rate of pilot pushes",
      "fill": 1,
      "gridPos": {
        "h": 8,
        "w": 8,
        "x": 0,
        "y": 15
      },
      "id": 622,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": false,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null as zero",
      "paceLength": 10,
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": true,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(irate(pilot_xds_pushes{type=\"cds\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Cluster",
          "refId": "C"
        },
        {
          "expr": "sum(irate(pilot_xds_pushes{type=\"eds\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Endpoints",
          "refId": "D"
        },
        {
          "expr": "sum(irate(pilot_xds_pushes{type=\"lds\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Listeners",
          "refId": "A"
        },
        {
          "expr": "sum(irate(pilot_xds_pushes{type=\"rds\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Routes",
          "refId": "E"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Pilot Pushes",
      "tooltip": {
        "shared": false,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": [
          "total"
        ]
      },
      "yaxes": [
        {
          "format": "ops",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "description": "Captures a variety of pilot errors",
      "fill": 1,
      "gridPos": {
        "h": 8,
        "w": 8,
        "x": 8,
        "y": 15
      },
      "id": 67,
      "legend": {
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "hideZero": true,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(pilot_xds_cds_reject{job=\"pilot\"}) or (absent(pilot_xds_cds_reject{job=\"pilot\"}) - 1)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "Rejected CDS Configs",
          "refId": "C"
        },
        {
          "expr": "sum(pilot_xds_eds_reject{job=\"pilot\"}) or (absent(pilot_xds_eds_reject{job=\"pilot\"}) - 1)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "Rejected EDS Configs",
          "refId": "D"
        },
        {
          "expr": "sum(pilot_xds_rds_reject{job=\"pilot\"}) or (absent(pilot_xds_rds_reject{job=\"pilot\"}) - 1)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "Rejected RDS Configs",
          "refId": "A"
        },
        {
          "expr": "sum(pilot_xds_lds_reject{job=\"pilot\"}) or (absent(pilot_xds_lds_reject{job=\"pilot\"}) - 1)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "Rejected LDS Configs",
          "refId": "B"
        },
        {
          "expr": "sum(rate(pilot_xds_write_timeout{job=\"pilot\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Write Timeouts",
          "refId": "F"
        },
        {
          "expr": "sum(rate(pilot_total_xds_internal_errors{job=\"pilot\"}[1m]))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "Internal Errors",
          "refId": "H"
        },
        {
          "expr": "sum(rate(pilot_total_xds_rejects{job=\"pilot\"}[1m]))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "Config Rejection Rate",
          "refId": "E"
        },
        {
          "expr": "sum(rate(pilot_xds_push_context_errors{job=\"pilot\"}[1m]))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "Push Context Errors",
          "refId": "K"
        },
        {
          "expr": "sum(rate(pilot_xds_pushes{type!~\"lds|cds|rds|eds\"}[1m])) by (type)",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Push Errors ({{ type }})",
          "refId": "L"
        },
        {
          "expr": "sum(rate(pilot_xds_push_errors{job=\"pilot\"}[1m])) by (type)",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "Push Errors ({{ type }})",
          "refId": "I"
        },
        {
          "expr": "sum(rate(pilot_xds_push_timeout{job=\"pilot\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Push Timeouts",
          "refId": "G"
        },
        {
          "expr": "sum(rate(pilot_xds_push_timeout_failures{job=\"pilot\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Push Timeouts Failures",
          "refId": "J"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Pilot Errors",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "description": "Shows the total time it takes to push a config update to a proxy",
      "fill": 1,
      "gridPos": {
        "h": 8,
        "w": 8,
        "x": 16,
        "y": 15
      },
      "id": 624,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "histogram_quantile(0.5, sum(rate(pilot_proxy_convergence_time_bucket[1m])) by (le))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "p50 ",
          "refId": "A"
        },
        {
          "expr": "histogram_quantile(0.9, sum(rate(pilot_proxy_convergence_time_bucket[1m])) by (le))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "p90",
          "refId": "B"
        },
        {
          "expr": "histogram_quantile(0.99, sum(rate(pilot_proxy_convergence_time_bucket[1m])) by (le))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "p99",
          "refId": "C"
        },
        {
          "expr": "histogram_quantile(0.999, sum(rate(pilot_proxy_convergence_time_bucket[1m])) by (le))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "p99.9",
          "refId": "D"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Proxy Push Time",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "s",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 8,
        "w": 8,
        "x": 0,
        "y": 23
      },
      "id": 45,
      "legend": {
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "hideZero": true,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null as zero",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "pilot_conflict_inbound_listener{job=\"pilot\"}",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "Inbound Listeners",
          "refId": "B"
        },
        {
          "expr": "pilot_conflict_outbound_listener_http_over_current_tcp{job=\"pilot\"}",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "Outbound Listeners (http over current tcp)",
          "refId": "A"
        },
        {
          "expr": "pilot_conflict_outbound_listener_tcp_over_current_tcp{job=\"pilot\"}",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "Outbound Listeners (tcp over current tcp)",
          "refId": "C"
        },
        {
          "expr": "pilot_conflict_outbound_listener_tcp_over_current_http{job=\"pilot\"}",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "Outbound Listeners (tcp over current http)",
          "refId": "D"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Conflicts",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 8,
        "w": 8,
        "x": 8,
        "y": 23
      },
      "id": 47,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "pilot_virt_services{job=\"pilot\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Virtual Services",
          "refId": "A"
        },
        {
          "expr": "pilot_services{job=\"pilot\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Services",
          "refId": "B"
        },
        {
          "expr": "pilot_xds{job=\"pilot\"}",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Connected Endpoints",
          "refId": "E"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "ADS Monitoring",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "columns": [],
      "datasource": "Prometheus",
      "description": "Clusters in this table do not have any endpoints known to pilot. This could be from referencing subsets that do not have any instances, or pods marked as NotReady",
      "fontSize": "100%",
      "gridPos": {
        "h": 8,
        "w": 8,
        "x": 16,
        "y": 23
      },
      "id": 51,
      "links": [],
      "pageSize": null,
      "scroll": true,
      "showHeader": true,
      "sort": {
        "col": null,
        "desc": false
      },
      "styles": [
        {
          "alias": "Time",
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "pattern": "Time",
          "type": "date"
        },
        {
          "alias": "Clusters",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "decimals": 2,
          "pattern": "/.*/",
          "thresholds": [],
          "type": "number",
          "unit": "short"
        }
      ],
      "targets": [
        {
          "expr": "sum(pilot_xds_eds_instances{job=\"pilot\", cluster=~\".+\\\\|.+\"}) by (cluster) < 1",
          "format": "time_series",
          "hide": false,
          "instant": true,
          "intervalFactor": 1,
          "legendFormat": "{{cluster}}",
          "refId": "B"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Clusters with no known endpoints",
      "transform": "timeseries_aggregations",
      "type": "table"
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 31
      },
      "id": 64,
      "panels": [],
      "title": "Envoy Information",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "description": "Shows details about Envoy proxies in the mesh",
      "fill": 1,
      "gridPos": {
        "h": 8,
        "w": 8,
        "x": 0,
        "y": 32
      },
      "id": 40,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(irate(envoy_cluster_upstream_cx_total{cluster_name=\"xds-grpc\"}[1m]))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "XDS Connections",
          "refId": "C"
        },
        {
          "expr": "sum(irate(envoy_cluster_upstream_cx_connect_fail{cluster_name=\"xds-grpc\"}[1m]))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "XDS Connection Failures",
          "refId": "A"
        },
        {
          "expr": "sum(increase(envoy_server_hot_restart_epoch[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "Envoy Restarts",
          "refId": "B"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Envoy Details",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "ops",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "ops",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "fill": 1,
      "gridPos": {
        "h": 8,
        "w": 8,
        "x": 8,
        "y": 32
      },
      "id": 41,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "sum(envoy_cluster_upstream_cx_active{cluster_name=\"xds-grpc\"})",
          "format": "time_series",
          "intervalFactor": 2,
          "legendFormat": "XDS Active Connections",
          "refId": "C",
          "step": 2
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "XDS Active Connections",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "Prometheus",
      "description": "Shows the size of XDS requests and responses",
      "fill": 1,
      "gridPos": {
        "h": 8,
        "w": 8,
        "x": 16,
        "y": 32
      },
      "id": 42,
      "legend": {
        "avg": false,
        "current": false,
        "hideEmpty": false,
        "hideZero": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": false
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "expr": "max(rate(envoy_cluster_upstream_cx_rx_bytes_total{cluster_name=\"xds-grpc\"}[1m]))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "XDS Response Bytes Max",
          "refId": "D"
        },
        {
          "expr": "quantile(0.5, rate(envoy_cluster_upstream_cx_rx_bytes_total{cluster_name=\"xds-grpc\"}[1m]))",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "XDS Response Bytes Average",
          "refId": "B"
        },
        {
          "expr": "max(rate(envoy_cluster_upstream_cx_tx_bytes_total{cluster_name=\"xds-grpc\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "XDS Request Bytes Max",
          "refId": "A"
        },
        {
          "expr": "quantile(.5, rate(envoy_cluster_upstream_cx_tx_bytes_total{cluster_name=\"xds-grpc\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "XDS Request Bytes Average",
          "refId": "C"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "XDS Requests Size",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "Bps",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "ops",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": false
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    }
  ],
  "refresh": "5s",
  "schemaVersion": 18,
  "style": "dark",
  "tags": [],
  "templating": {
    "list": []
  },
  "time": {
    "from": "now-5m",
    "to": "now"
  },
  "timepicker": {
    "refresh_intervals": [
      "5s",
      "10s",
      "30s",
      "1m",
      "5m",
      "15m",
      "30m",
      "1h",
      "2h",
      "1d"
    ],
    "time_options": [
      "5m",
      "15m",
      "1h",
      "6h",
      "12h",
      "24h",
      "2d",
      "7d",
      "30d"
    ]
  },
  "timezone": "browser",
  "title": "Istio Pilot Dashboard",
  "uid": "3--MLVZZk",
  "version": 11
}`)

func chartsIstioTelemetryGrafanaDashboardsPilotDashboardJsonBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaDashboardsPilotDashboardJson, nil
}

func chartsIstioTelemetryGrafanaDashboardsPilotDashboardJson() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaDashboardsPilotDashboardJsonBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/dashboards/pilot-dashboard.json", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaFix_datasourcesSh = []byte(`#!/bin/bash

# Copyright Istio Authors
#
#   Licensed under the Apache License, Version 2.0 (the "License");
#   you may not use this file except in compliance with the License.
#   You may obtain a copy of the License at
#
#       http://www.apache.org/licenses/LICENSE-2.0
#
#   Unless required by applicable law or agreed to in writing, software
#   distributed under the License is distributed on an "AS IS" BASIS,
#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#   See the License for the specific language governing permissions and
#   limitations under the License.

set -e

THIS_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
UX=$(uname)

for db in "${THIS_DIR}"/dashboards/*.json; do
    if [[ ${UX} == "Darwin" ]]; then
        # shellcheck disable=SC2016
        sed -i '' 's/${DS_PROMETHEUS}/Prometheus/g' "$db"
    else
        # shellcheck disable=SC2016
        sed -i 's/${DS_PROMETHEUS}/Prometheus/g' "$db"
    fi
done
`)

func chartsIstioTelemetryGrafanaFix_datasourcesShBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaFix_datasourcesSh, nil
}

func chartsIstioTelemetryGrafanaFix_datasourcesSh() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaFix_datasourcesShBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/fix_datasources.sh", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaTemplates_affinityTpl = []byte(`{{/* affinity - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ */}}

{{- define "nodeaffinity" }}
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityRequiredDuringScheduling" . }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityPreferredDuringScheduling" . }}
{{- end }}

{{- define "nodeAffinityRequiredDuringScheduling" }}
      nodeSelectorTerms:
      - matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
        {{- range $key, $val := .Values.global.arch }}
          {{- if gt ($val | int) 0 }}
          - {{ $key | quote }}
          {{- end }}
        {{- end }}
        {{- $nodeSelector := default .Values.global.defaultNodeSelector .Values.grafana.nodeSelector -}}
        {{- range $key, $val := $nodeSelector }}
        - key: {{ $key }}
          operator: In
          values:
          - {{ $val | quote }}
        {{- end }}
{{- end }}

{{- define "nodeAffinityPreferredDuringScheduling" }}
  {{- range $key, $val := .Values.global.arch }}
    {{- if gt ($val | int) 0 }}
    - weight: {{ $val | int }}
      preference:
        matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
          - {{ $key | quote }}
    {{- end }}
  {{- end }}
{{- end }}

{{- define "podAntiAffinity" }}
{{- if or .Values.grafana.podAntiAffinityLabelSelector .Values.grafana.podAntiAffinityTermLabelSelector}}
  podAntiAffinity:
    {{- if .Values.grafana.podAntiAffinityLabelSelector }}
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityRequiredDuringScheduling" . }}
    {{- end }}
    {{- if .Values.grafana.podAntiAffinityTermLabelSelector }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityPreferredDuringScheduling" . }}
    {{- end }}
{{- end }}
{{- end }}

{{- define "podAntiAffinityRequiredDuringScheduling" }}
    {{- range $index, $item := .Values.grafana.podAntiAffinityLabelSelector }}
    - labelSelector:
        matchExpressions:
        - key: {{ $item.key }}
          operator: {{ $item.operator }}
          {{- if $item.values }}
          values:
          {{- $vals := split "," $item.values }}
          {{- range $i, $v := $vals }}
          - {{ $v | quote }}
          {{- end }}
          {{- end }}
      topologyKey: {{ $item.topologyKey }}
    {{- end }}
{{- end }}

{{- define "podAntiAffinityPreferredDuringScheduling" }}
    {{- range $index, $item := .Values.grafana.podAntiAffinityTermLabelSelector }}
    - podAffinityTerm:
        labelSelector:
          matchExpressions:
          - key: {{ $item.key }}
            operator: {{ $item.operator }}
            {{- if $item.values }}
            values:
            {{- $vals := split "," $item.values }}
            {{- range $i, $v := $vals }}
            - {{ $v | quote }}
            {{- end }}
            {{- end }}
        topologyKey: {{ $item.topologyKey }}
      weight: 100
    {{- end }}
{{- end }}
`)

func chartsIstioTelemetryGrafanaTemplates_affinityTplBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaTemplates_affinityTpl, nil
}

func chartsIstioTelemetryGrafanaTemplates_affinityTpl() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaTemplates_affinityTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/templates/_affinity.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaTemplatesConfigmapDashboardsYaml = []byte(`{{- $files := .Files }}
{{- range $path, $bytes := .Files.Glob "dashboards/*.json" }}
{{- $filename := trimSuffix (ext $path) (base $path) }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-grafana-configuration-dashboards-{{ $filename }}
  namespace: {{ $.Release.Namespace }}
  labels:
    app: grafana
    release: {{ $.Release.Name }}
    istio: grafana
data:
  {{ base $path }}: '{{ $files.Get $path }}'
---
{{- end }}
`)

func chartsIstioTelemetryGrafanaTemplatesConfigmapDashboardsYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaTemplatesConfigmapDashboardsYaml, nil
}

func chartsIstioTelemetryGrafanaTemplatesConfigmapDashboardsYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaTemplatesConfigmapDashboardsYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/templates/configmap-dashboards.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaTemplatesConfigmapYaml = []byte(`apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-grafana
  namespace: {{ .Release.Namespace }}
  labels:
    app: grafana
    release: {{ .Release.Name }}
    istio: grafana
data:
{{- if .Values.grafana.datasources }}
  {{- range $key, $value := .Values.grafana.datasources }}
  {{ $key }}: |
{{ toYaml $value | indent 4 }}
  {{- end -}}
{{- end -}}

{{- if .Values.grafana.dashboardProviders }}
  {{- range $key, $value := .Values.grafana.dashboardProviders }}
  {{ $key }}: |
{{ toYaml $value | indent 4 }}
  {{- end -}}
{{- end -}}
`)

func chartsIstioTelemetryGrafanaTemplatesConfigmapYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaTemplatesConfigmapYaml, nil
}

func chartsIstioTelemetryGrafanaTemplatesConfigmapYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaTemplatesConfigmapYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/templates/configmap.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaTemplatesDeploymentYaml = []byte(`apiVersion: apps/v1
kind: Deployment
metadata:
  name: grafana
  namespace: {{ .Release.Namespace }}
  labels:
    app: grafana
    release: {{ .Release.Name }}
spec:
  replicas: {{ .Values.grafana.replicaCount }}
  selector:
    matchLabels:
      app: grafana
  template:
    metadata:
      labels:
        app: grafana
        chart: grafana
        heritage: Tiller
        release: istio-system
      annotations:
        sidecar.istio.io/inject: "false"
        {{- if .Values.grafana.podAnnotations }}
{{ toYaml .Values.grafana.podAnnotations | indent 8 }}
        {{- end }}
    spec:
      securityContext:
        runAsUser: 472
        fsGroup: 472
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
{{- if .Values.global.imagePullSecrets }}
      imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
        - name: {{ . }}
{{- end }}
{{- end }}
      containers:
        - name: {{ .Chart.Name }}
          image: "{{ .Values.grafana.image.repository }}:{{ .Values.grafana.image.tag }}"
          imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
          ports:
          - containerPort: 3000
          readinessProbe:
            httpGet:
              path: /api/health
              port: 3000
          env:
          - name: GRAFANA_PORT
            value: "3000"
{{- if .Values.grafana.security.enabled }}
          - name: GF_SECURITY_ADMIN_USER
            valueFrom:
              secretKeyRef:
                name: {{ .Values.grafana.security.secretName }}
                key: {{ .Values.grafana.security.usernameKey }}
          - name: GF_SECURITY_ADMIN_PASSWORD
            valueFrom:
              secretKeyRef:
                name: {{ .Values.grafana.security.secretName }}
                key: {{ .Values.grafana.security.passphraseKey }}
          - name: GF_AUTH_BASIC_ENABLED
            value: "true"
          - name: GF_AUTH_ANONYMOUS_ENABLED
            value: "false"
          - name: GF_AUTH_DISABLE_LOGIN_FORM
            value: "false"
{{- else }}
          - name: GF_AUTH_BASIC_ENABLED
            value: "false"
          - name: GF_AUTH_ANONYMOUS_ENABLED
            value: "true"
          - name: GF_AUTH_ANONYMOUS_ORG_ROLE
            value: Admin
{{- end }}
          - name: GF_PATHS_DATA
            value: /data/grafana
          {{- range $key, $value := $.Values.grafana.env }}
          - name: {{ $key }}
            value: {{ $value | quote }}
          {{- end }}
          {{- range $key, $secret := $.Values.grafana.envSecrets }}
          - name: {{ $key }}
            valueFrom:
              secretKeyRef:
                name: {{ $secret }}
                key: {{ $key | quote }}
          {{- end }}
          resources:
{{- if .Values.grafana.resources }}
{{ toYaml .Values.grafana.resources | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 12 }}
{{- end }}
          volumeMounts:
          - name: data
            mountPath: /data/grafana
          {{- range $path, $bytes := .Files.Glob "dashboards/*.json" }}
          {{- $filename := trimSuffix (ext $path) (base $path) }}
          - name: dashboards-istio-{{ $filename }}
            mountPath: "/var/lib/grafana/dashboards/istio/{{ base $path }}"
            subPath: {{ base $path }}
            readOnly: true
          {{- end }}
          - name: config
            mountPath: "/etc/grafana/provisioning/datasources/datasources.yaml"
            subPath: datasources.yaml
          - name: config
            mountPath: "/etc/grafana/provisioning/dashboards/dashboardproviders.yaml"
            subPath: dashboardproviders.yaml
      affinity:
      {{- include "nodeaffinity" . | indent 6 }}
      {{- include "podAntiAffinity" . | indent 6 }}
{{- if .Values.grafana.tolerations }}
      tolerations:
{{ toYaml .Values.grafana.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}
      volumes:
      - name: config
        configMap:
          name: istio-grafana
      - name: data
{{- if .Values.grafana.persist }}
        persistentVolumeClaim:
          claimName: istio-grafana-pvc
{{- else }}
        emptyDir: {}
{{- end }}
{{- range $path, $bytes := .Files.Glob "dashboards/*.json" }}
{{- $filename := trimSuffix (ext $path) (base $path) }}
      - name: dashboards-istio-{{ $filename }}
        configMap:
          name: istio-grafana-configuration-dashboards-{{ $filename }}
{{- end }}
`)

func chartsIstioTelemetryGrafanaTemplatesDeploymentYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaTemplatesDeploymentYaml, nil
}

func chartsIstioTelemetryGrafanaTemplatesDeploymentYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaTemplatesDeploymentYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/templates/deployment.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaTemplatesGrafanaPolicyYaml = []byte(`apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
  name: grafana-ports-mtls-disabled
  namespace: {{ .Release.Namespace }}
  labels:
    app: grafana
    release: {{ .Release.Name }}
spec:
  targets:
  - name: grafana
    ports:
    - number: {{ .Values.grafana.service.externalPort }}
`)

func chartsIstioTelemetryGrafanaTemplatesGrafanaPolicyYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaTemplatesGrafanaPolicyYaml, nil
}

func chartsIstioTelemetryGrafanaTemplatesGrafanaPolicyYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaTemplatesGrafanaPolicyYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/templates/grafana-policy.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaTemplatesPvcYaml = []byte(`{{- if .Values.grafana.persist }}
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: istio-grafana-pvc
  namespace: {{ .Release.Namespace }}
  labels:
    app: grafana
    release: {{ .Release.Name }}
spec:
  storageClassName: {{ .Values.grafana.storageClassName }}
  accessModes:
    - {{ .Values.grafana.accessMode }}
  resources:
    requests:
      storage: 5Gi
{{- end }}
`)

func chartsIstioTelemetryGrafanaTemplatesPvcYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaTemplatesPvcYaml, nil
}

func chartsIstioTelemetryGrafanaTemplatesPvcYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaTemplatesPvcYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/templates/pvc.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaTemplatesServiceYaml = []byte(`apiVersion: v1
kind: Service
metadata:
  name: grafana
  namespace: {{ .Release.Namespace }}
  annotations:
    {{- range $key, $val := .Values.grafana.service.annotations }}
    {{ $key }}: {{ $val | quote }}
    {{- end }}
  labels:
    app: grafana
    release: {{ .Release.Name }}
spec:
  type: {{ .Values.grafana.service.type }}
  ports:
    - port: {{ .Values.grafana.service.externalPort }}
      targetPort: 3000
      protocol: TCP
      name: {{ .Values.grafana.service.name }}
  selector:
    app: grafana
{{- if .Values.grafana.service.loadBalancerIP }}
  loadBalancerIP: "{{ .Values.grafana.service.loadBalancerIP }}"
{{- end }}
  {{if .Values.grafana.service.loadBalancerSourceRanges}}
  loadBalancerSourceRanges:
    {{range $rangeList := .Values.grafana.service.loadBalancerSourceRanges}}
    - {{ $rangeList }}
    {{end}}
  {{end}}
`)

func chartsIstioTelemetryGrafanaTemplatesServiceYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaTemplatesServiceYaml, nil
}

func chartsIstioTelemetryGrafanaTemplatesServiceYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaTemplatesServiceYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/templates/service.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaTemplatesTestsTestGrafanaConnectionYaml = []byte(`{{- if .Values.global.enableHelmTest }}
apiVersion: v1
kind: Pod
metadata:
  name: grafana-test
  namespace: {{ .Release.Namespace }}
  labels:
    app: grafana-test
    release: {{ .Release.Name }}
    istio: grafana
  annotations:
    sidecar.istio.io/inject: "false"
    helm.sh/hook: test-success
spec:
{{- if .Values.global.priorityClassName }}
  priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
  containers:
    - name: "grafana-test"
      image: {{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}
      imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
      command: ['curl']
      args: ['http://grafana:{{ .Values.grafana.service.externalPort }}']
  restartPolicy: Never
  affinity:
    {{- include "nodeaffinity" . | indent 4 }}
    {{- include "podAntiAffinity" . | indent 4 }}
{{- end }}
`)

func chartsIstioTelemetryGrafanaTemplatesTestsTestGrafanaConnectionYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaTemplatesTestsTestGrafanaConnectionYaml, nil
}

func chartsIstioTelemetryGrafanaTemplatesTestsTestGrafanaConnectionYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaTemplatesTestsTestGrafanaConnectionYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/templates/tests/test-grafana-connection.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryGrafanaValuesYaml = []byte(`grafana:
  enabled: true
  replicaCount: 1
  image:
    repository: grafana/grafana
    tag: 6.7.4
  persist: false
  storageClassName: ""
  accessMode: ReadWriteMany
  security:
    enabled: false
    secretName: grafana
    usernameKey: username
    passphraseKey: passphrase

  contextPath: /grafana
  service:
    annotations: {}
    name: http
    type: ClusterIP
    externalPort: 3000
    loadBalancerIP: ""
    loadBalancerSourceRanges: ""

  ingress:
    enabled: false
    ## Used to create an Ingress record.
    hosts:
      - grafana.local
    annotations:
      # kubernetes.io/ingress.class: nginx
      # kubernetes.io/tls-acme: "true"
    tls:
      # Secrets must be manually created in the namespace.
      # - secretName: grafana-tls
      #   hosts:
      #     - grafana.local

  # Optional: prometheus may be deployed in a different namespace
  # prometheusNamespace: istio-telemetry

  # Additional datasources. Prometheus included in the config map.
  datasources:
    datasources.yaml:
      apiVersion: 1
      datasources:
      - name: Prometheus
        type: prometheus
        orgId: 1
        url: http://prometheus:9090
        access: proxy
        isDefault: true
        jsonData:
          timeInterval: 5s
        editable: true

  dashboardProviders:
    dashboardproviders.yaml:
      apiVersion: 1
      providers:
        - name: 'istio'
          orgId: 1
          folder: 'istio'
          type: file
          disableDeletion: false
          options:
            path: /var/lib/grafana/dashboards/istio

  nodeSelector: {}
  tolerations: []
  podAnnotations: {}

  env: {}
    # Define additional environment variables for configuring grafana.
    # @see https://grafana.com/docs/installation/configuration/#using-environment-variables
    # Format: env_variable_name: value
    # For example:
    # GF_SMTP_ENABLED: true
    # GF_SMTP_HOST: email-smtp.eu-west-1.amazonaws.com:2587
    # GF_SMTP_FROM_ADDRESS: alerts@mydomain.com
    # GF_SMTP_FROM_NAME: Grafana

  envSecrets: {}
    # The key name and ENV name must match in the secrets file.
    # @see https://grafana.com/docs/installation/configuration/#using-environment-variables
    # For example:
    # ---
    # apiVersion: v1
    # kind: Secret
    # metadata:
    #   name: grafana-secrets
    #   namespace: istio-system
    # data:
    #   GF_SMTP_USER: bXl1c2Vy
    #   GF_SMTP_PASSWORD: bXlwYXNzd29yZA==
    # type: Opaque
    # ---
    # env_variable_key_name: secretsName
    # ---
    # GF_SMTP_USER: grafana-secrets
    # GF_SMTP_PASSWORD: grafana-secrets

  resources: {}

  prometheusNamespace: ""

  # Specify the pod anti-affinity that allows you to constrain which nodes
  # your pod is eligible to be scheduled based on labels on pods that are
  # already running on the node rather than based on labels on nodes.
  # There are currently two types of anti-affinity:
  #    "requiredDuringSchedulingIgnoredDuringExecution"
  #    "preferredDuringSchedulingIgnoredDuringExecution"
  # which denote "hard" vs. "soft" requirements, you can define your values
  # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
  # correspondingly.
  # For example:
  # podAntiAffinityLabelSelector:
  # - key: security
  #   operator: In
  #   values: S1,S2
  #   topologyKey: "kubernetes.io/hostname"
  # This pod anti-affinity rule says that the pod requires not to be scheduled
  # onto a node if that node is already running a pod with label having key
  # "security" and value "S1".
  podAntiAffinityLabelSelector: []
  podAntiAffinityTermLabelSelector: []
`)

func chartsIstioTelemetryGrafanaValuesYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryGrafanaValuesYaml, nil
}

func chartsIstioTelemetryGrafanaValuesYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryGrafanaValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/grafana/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryKialiChartYaml = []byte(`apiVersion: v1
description: Kiali is an open source project for service mesh observability, refer to https://www.kiali.io for details.
name: kiali
version: 1.15.0
appVersion: 1.15.0
tillerVersion: ">=2.7.2"
`)

func chartsIstioTelemetryKialiChartYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryKialiChartYaml, nil
}

func chartsIstioTelemetryKialiChartYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryKialiChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/kiali/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryKialiTemplates_affinityTpl = []byte(`{{/* affinity - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ */}}

{{- define "nodeaffinity" }}
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityRequiredDuringScheduling" . }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityPreferredDuringScheduling" . }}
{{- end }}

{{- define "nodeAffinityRequiredDuringScheduling" }}
      nodeSelectorTerms:
      - matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
        {{- range $key, $val := .Values.global.arch }}
          {{- if gt ($val | int) 0 }}
          - {{ $key | quote }}
          {{- end }}
        {{- end }}
        {{- $nodeSelector := default .Values.global.defaultNodeSelector .Values.kiali.nodeSelector -}}
        {{- range $key, $val := $nodeSelector }}
        - key: {{ $key }}
          operator: In
          values:
          - {{ $val | quote }}
        {{- end }}
{{- end }}

{{- define "nodeAffinityPreferredDuringScheduling" }}
  {{- range $key, $val := .Values.global.arch }}
    {{- if gt ($val | int) 0 }}
    - weight: {{ $val | int }}
      preference:
        matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
          - {{ $key | quote }}
    {{- end }}
  {{- end }}
{{- end }}

{{- define "podAntiAffinity" }}
{{- if or .Values.kiali.podAntiAffinityLabelSelector .Values.kiali.podAntiAffinityTermLabelSelector}}
  podAntiAffinity:
    {{- if .Values.kiali.podAntiAffinityLabelSelector }}
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityRequiredDuringScheduling" . }}
    {{- end }}
    {{- if or .Values.kiali.podAntiAffinityTermLabelSelector}}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityPreferredDuringScheduling" . }}
    {{- end }}
{{- end }}
{{- end }}

{{- define "podAntiAffinityRequiredDuringScheduling" }}
    {{- range $index, $item := .Values.kiali.podAntiAffinityLabelSelector }}
    - labelSelector:
        matchExpressions:
        - key: {{ $item.key }}
          operator: {{ $item.operator }}
          {{- if $item.values }}
          values:
          {{- $vals := split "," $item.values }}
          {{- range $i, $v := $vals }}
          - {{ $v | quote }}
          {{- end }}
          {{- end }}
      topologyKey: {{ $item.topologyKey }}
    {{- end }}
{{- end }}

{{- define "podAntiAffinityPreferredDuringScheduling" }}
    {{- range $index, $item := .Values.kiali.podAntiAffinityTermLabelSelector }}
    - podAffinityTerm:
        labelSelector:
          matchExpressions:
          - key: {{ $item.key }}
            operator: {{ $item.operator }}
            {{- if $item.values }}
            values:
            {{- $vals := split "," $item.values }}
            {{- range $i, $v := $vals }}
            - {{ $v | quote }}
            {{- end }}
            {{- end }}
        topologyKey: {{ $item.topologyKey }}
      weight: 100
    {{- end }}
{{- end }}
`)

func chartsIstioTelemetryKialiTemplates_affinityTplBytes() ([]byte, error) {
	return _chartsIstioTelemetryKialiTemplates_affinityTpl, nil
}

func chartsIstioTelemetryKialiTemplates_affinityTpl() (*asset, error) {
	bytes, err := chartsIstioTelemetryKialiTemplates_affinityTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/kiali/templates/_affinity.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryKialiTemplatesClusterroleYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kiali
  labels:
    app: kiali
    release: {{ .Release.Name }}
rules:
  - apiGroups: [""]
    resources:
      - configmaps
      - endpoints
      - namespaces
      - nodes
      - pods
      - pods/log
      - replicationcontrollers
      - services
    verbs:
      - get
      - list
      - watch
  - apiGroups: ["extensions", "apps"]
    resources:
      - deployments
      - replicasets
      - statefulsets
    verbs:
      - get
      - list
      - watch
  - apiGroups: ["autoscaling"]
    resources:
      - horizontalpodautoscalers
    verbs:
      - get
      - list
      - watch
  - apiGroups: ["batch"]
    resources:
      - cronjobs
      - jobs
    verbs:
      - get
      - list
      - watch
  - apiGroups: 
    - config.istio.io
    - networking.istio.io
    - authentication.istio.io
    - rbac.istio.io
    - security.istio.io
    resources: ["*"]
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - watch
  - apiGroups: ["monitoring.kiali.io"]
    resources:
      - monitoringdashboards
    verbs:
      - get
      - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kiali-viewer
  labels:
    app: kiali
    release: {{ .Release.Name }}
rules:
  - apiGroups: [""]
    resources:
      - configmaps
      - endpoints
      - namespaces
      - nodes
      - pods
      - pods/log
      - replicationcontrollers
      - services
    verbs:
      - get
      - list
      - watch
  - apiGroups: ["extensions", "apps"]
    resources:
      - deployments
      - replicasets
      - statefulsets
    verbs:
      - get
      - list
      - watch
  - apiGroups: ["autoscaling"]
    resources:
      - horizontalpodautoscalers
    verbs:
      - get
      - list
      - watch
  - apiGroups: ["batch"]
    resources:
      - cronjobs
      - jobs
    verbs:
      - get
      - list
      - watch
  - apiGroups: 
    - config.istio.io
    - networking.istio.io
    - authentication.istio.io
    - rbac.istio.io
    - security.istio.io
    resources: ["*"]
    verbs:
      - get
      - list
      - watch
  - apiGroups: ["monitoring.kiali.io"]
    resources:
      - monitoringdashboards
    verbs:
      - get
      - list
`)

func chartsIstioTelemetryKialiTemplatesClusterroleYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryKialiTemplatesClusterroleYaml, nil
}

func chartsIstioTelemetryKialiTemplatesClusterroleYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryKialiTemplatesClusterroleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/kiali/templates/clusterrole.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryKialiTemplatesClusterrolebindingYaml = []byte(`{{- if not .Values.kiali.dashboard.viewOnlyMode }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kiali
  labels:
    app: kiali
    release: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kiali
subjects:
  - kind: ServiceAccount
    name: kiali-service-account
    namespace: {{ .Release.Namespace }}
{{- else }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-kiali-viewer-role-binding-{{ .Release.Namespace }}
  labels:
    app: kiali
    release: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kiali-viewer
subjects:
- kind: ServiceAccount
  name: kiali-service-account
  namespace: {{ .Release.Namespace }}
{{- end }}
`)

func chartsIstioTelemetryKialiTemplatesClusterrolebindingYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryKialiTemplatesClusterrolebindingYaml, nil
}

func chartsIstioTelemetryKialiTemplatesClusterrolebindingYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryKialiTemplatesClusterrolebindingYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/kiali/templates/clusterrolebinding.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryKialiTemplatesConfigmapYaml = []byte(`apiVersion: v1
kind: ConfigMap
metadata:
  name: kiali
  namespace: {{ .Release.Namespace }}
  labels:
    app: kiali
    release: {{ .Release.Name }}
data:
  config.yaml: |
    istio_component_namespaces:
      grafana: {{ .Values.global.telemetryNamespace }}
      tracing: {{ .Values.global.telemetryNamespace }}
      pilot: {{ .Values.global.configNamespace }}
      prometheus: {{ .Values.global.prometheusNamespace }}
    istio_namespace: {{ .Values.global.istioNamespace }}
    auth:
      strategy: {{ .Values.kiali.dashboard.auth.strategy }}
{{- if eq .Values.kiali.dashboard.auth.strategy "ldap" }}
      ldap:
{{- with .Values.kiali.dashboard.auth.strategy.ldap }}
{{ toYaml . | indent 8 }}
{{- end }}
{{- end }}
    deployment:
      accessible_namespaces: ['**']
    login_token:
      signing_key: {{ randAlphaNum 10 | quote }}
    server:
      port: 20001
{{- if .Values.kiali.contextPath }}
      web_root: {{ .Values.kiali.contextPath }}
{{- end }}
    external_services:
      istio:
        url_service_version: http://istio-pilot.{{ .Values.global.configNamespace }}:8080/version
      tracing:
        url: {{ .Values.kiali.dashboard.jaegerURL }}
        in_cluster_url: {{ .Values.kiali.dashboard.jaegerInClusterURL }}
      grafana:
        url: {{ .Values.kiali.dashboard.grafanaURL }}
        in_cluster_url: {{ .Values.kiali.dashboard.grafanaInClusterURL }}
      prometheus:
{{- if .Values.kiali.prometheusAddr}}
        url: {{ .Values.kiali.prometheusAddr}}
{{- else }}
{{- if .Values.global.prometheusNamespace }}
        url: http://prometheus.{{ .Values.global.prometheusNamespace }}:9090
{{ else }}
        url: http://prometheus:9090
{{- end }}
{{- end}}
{{- if .Values.kiali.security.enabled }}
    identity:
      cert_file: {{ .Values.kiali.security.cert_file }}
      private_key_file: {{ .Values.kiali.security.private_key_file }}
{{- end}}
`)

func chartsIstioTelemetryKialiTemplatesConfigmapYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryKialiTemplatesConfigmapYaml, nil
}

func chartsIstioTelemetryKialiTemplatesConfigmapYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryKialiTemplatesConfigmapYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/kiali/templates/configmap.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryKialiTemplatesDemosecretYaml = []byte(`{{- if .Values.kiali.createDemoSecret }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ .Values.kiali.dashboard.secretName }}
  namespace: {{ .Release.Namespace }}
  labels:
    app: kiali
    release: {{ .Release.Name }}
type: Opaque
data:
  username: YWRtaW4=   # admin
  passphrase: YWRtaW4= # admin
{{- end }}
`)

func chartsIstioTelemetryKialiTemplatesDemosecretYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryKialiTemplatesDemosecretYaml, nil
}

func chartsIstioTelemetryKialiTemplatesDemosecretYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryKialiTemplatesDemosecretYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/kiali/templates/demosecret.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryKialiTemplatesDeploymentYaml = []byte(`apiVersion: apps/v1
kind: Deployment
metadata:
  name: kiali
  namespace: {{ .Release.Namespace }}
  labels:
    app: kiali
    release: {{ .Release.Name }}
spec:
  replicas: {{ .Values.kiali.replicaCount }}
  selector:
    matchLabels:
      app: kiali
  template:
    metadata:
      name: kiali
      labels:
        app: kiali
        release: {{ .Release.Name }}
      annotations:
        sidecar.istio.io/inject: "false"
        scheduler.alpha.kubernetes.io/critical-pod: ""
        prometheus.io/scrape: "true"
        prometheus.io/port: "9090"
        kiali.io/runtimes: go,kiali
        {{- if .Values.kiali.podAnnotations }}
{{ toYaml .Values.kiali.podAnnotations | indent 8 }}
        {{- end }}
    spec:
      serviceAccountName: kiali-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      containers:
      - image: "{{ .Values.kiali.hub }}/{{ .Values.kiali.image }}:{{ .Values.kiali.tag }}"
        imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
        name: kiali
        command:
        - "/opt/kiali/kiali"
        - "-config"
        - "/kiali-configuration/config.yaml"
        - "-v"
        - "3"
        readinessProbe:
          httpGet:
            path: {{ .Values.kiali.contextPath }}/healthz
            port: 20001
            scheme: {{ if .Values.kiali.security.enabled }}'HTTPS'{{ else }}'HTTP'{{ end }}
          initialDelaySeconds: 5
          periodSeconds: 30
        livenessProbe:
          httpGet:
            path: {{ .Values.kiali.contextPath }}/healthz
            port: 20001
            scheme: {{ if .Values.kiali.security.enabled }}'HTTPS'{{ else }}'HTTP'{{ end }}
          initialDelaySeconds: 5
          periodSeconds: 30
        env:
        - name: ACTIVE_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        volumeMounts:
        - name: kiali-configuration
          mountPath: "/kiali-configuration"
        - name: kiali-cert
          mountPath: "/kiali-cert"
        - name: kiali-secret
          mountPath: "/kiali-secret"
        resources:
{{- if .Values.kiali.resources }}
{{ toYaml .Values.kiali.resources | indent 10 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 10 }}
{{- end }}
      volumes:
      - name: kiali-configuration
        configMap:
          name: kiali
      - name: kiali-cert
        secret:
          secretName: istio.kiali-service-account
{{- if not .Values.kiali.security.enabled }}
          optional: true
{{- end }}      
      - name: kiali-secret
        secret:
          secretName: {{ .Values.kiali.dashboard.secretName }}
          optional: true
      affinity:
      {{- include "nodeaffinity" . | indent 6 }}
      {{- include "podAntiAffinity" . | indent 6 }}
{{- if .Values.kiali.tolerations }}
      tolerations:
{{ toYaml .Values.kiali.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}
`)

func chartsIstioTelemetryKialiTemplatesDeploymentYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryKialiTemplatesDeploymentYaml, nil
}

func chartsIstioTelemetryKialiTemplatesDeploymentYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryKialiTemplatesDeploymentYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/kiali/templates/deployment.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryKialiTemplatesServiceYaml = []byte(`apiVersion: v1
kind: Service
metadata:
  name: kiali
  namespace: {{ .Release.Namespace }}
  annotations:
    {{- range $key, $val := .Values.kiali.service.annotations }}
      {{ $key }}: {{ $val | quote }}
    {{- end }}
  labels:
    app: kiali
    release: {{ .Release.Name }}
spec:
  type: {{ .Values.kiali.service.type }}
  ports:
    - name: http-kiali
      protocol: TCP
      port: 20001
  selector:
    app: kiali
`)

func chartsIstioTelemetryKialiTemplatesServiceYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryKialiTemplatesServiceYaml, nil
}

func chartsIstioTelemetryKialiTemplatesServiceYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryKialiTemplatesServiceYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/kiali/templates/service.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryKialiTemplatesServiceaccountYaml = []byte(`apiVersion: v1
kind: ServiceAccount
  {{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
  {{- range .Values.global.imagePullSecrets }}
- name: {{ . }}
  {{- end }}
  {{- end }}
metadata:
  name: kiali-service-account
  namespace: {{ .Release.Namespace }}
  labels:
    app: kiali
    release: {{ .Release.Name }}
`)

func chartsIstioTelemetryKialiTemplatesServiceaccountYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryKialiTemplatesServiceaccountYaml, nil
}

func chartsIstioTelemetryKialiTemplatesServiceaccountYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryKialiTemplatesServiceaccountYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/kiali/templates/serviceaccount.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryKialiValuesYaml = []byte(`#
# addon kiali
#
kiali:
  enabled: false # Note that if using the demo or demo-auth yaml when installing via Helm, this default will be `+"`"+`true`+"`"+`.
  replicaCount: 1
  hub: quay.io/kiali
  tag: v1.15
  image: kiali
  contextPath: /kiali # The root context path to access the Kiali UI.
  nodeSelector: {}
  tolerations: []
  podAnnotations: {}

  # Specify the pod anti-affinity that allows you to constrain which nodes
  # your pod is eligible to be scheduled based on labels on pods that are
  # already running on the node rather than based on labels on nodes.
  # There are currently two types of anti-affinity:
  #    "requiredDuringSchedulingIgnoredDuringExecution"
  #    "preferredDuringSchedulingIgnoredDuringExecution"
  # which denote "hard" vs. "soft" requirements, you can define your values
  # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
  # correspondingly.
  # For example:
  # podAntiAffinityLabelSelector:
  # - key: security
  #   operator: In
  #   values: S1,S2
  #   topologyKey: "kubernetes.io/hostname"
  # This pod anti-affinity rule says that the pod requires not to be scheduled
  # onto a node if that node is already running a pod with label having key
  # "security" and value "S1".
  podAntiAffinityLabelSelector: []
  podAntiAffinityTermLabelSelector: []

  service:
    annotations: {}
    type: ClusterIP

  ingress:
    enabled: false
    ## Used to create an Ingress record.
    hosts:
      - kiali.local
    annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
    tls:
    # Secrets must be manually created in the namespace.
    # - secretName: kiali-tls
    #   hosts:
    #     - kiali.local

  dashboard:
    auth:
      strategy: login # Can be anonymous, login, openshift, or ldap
      # ldap: # This is required to use the ldap strategy
      #   ldap_base: "DC=example,DC=com"
      #   ldap_bind_dn: "CN={USERID},OU=xyz,OU=Users,OU=Accounts,DC=example,DC=com"
      #   ldap_group_filter: "(cn=%s)"
      #   ldap_host: "ldap-service.ldap-namespace"
      #   ldap_insecure_skip_verify: true
      #   ldap_mail_id_key: "mail"
      #   ldap_member_of_key: "memberOf"
      #   ldap_port: 123
      #   ldap_role_filter: ".*xyz.*"
      #   ldap_search_filter: "(&(name={USERID}))"
      #   ldap_use_ssl: false
      #   ldap_user_filter: "(cn=%s)"
      #   ldap_user_id_key: "cn"

    secretName: kiali # You must create a secret with this name - one is not provided out-of-box unless you've chose to create a demo secret.
    usernameKey: username # This is the key name within the secret whose value is the actual username.
    passphraseKey: passphrase # This is the key name within the secret whose value is the actual passphrase.

    viewOnlyMode: false # Bind the service account to a role with only read access

    grafanaURL: "" # If you have Grafana installed and it is accessible to client browsers, then set this to its external URL. Kiali will redirect users to this URL when Grafana metrics are to be shown.
    grafanaInClusterURL: "http://grafana:3000" # In Kubernetes cluster with ELB in front this option is needed, since public IP of ELB is not reachable from inside the cluster
    jaegerURL: "" # If you have Jaeger installed and it is accessible to client browsers, then set this property to its external URL. Kiali will redirect users to this URL when Jaeger tracing is to be shown.
    jaegerInClusterURL: "http://tracing/jaeger" # If you have Jaeger installed and accessible from Kiali pod (typically in cluster), then set this property to enable more tracing charts within Kiali.

  createDemoSecret: true # When true, a secret will be created with a default username and password. Useful for demos.

  prometheusAddr: ""
  resources: {}
  security:
    enabled: false
    cert_file: /kiali-cert/cert-chain.pem
    private_key_file: /kiali-cert/key.pem
`)

func chartsIstioTelemetryKialiValuesYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryKialiValuesYaml, nil
}

func chartsIstioTelemetryKialiValuesYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryKialiValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/kiali/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryMixerTelemetryChartYaml = []byte(`apiVersion: v1
name: mixer-telemetry
version: 1.1.0
appVersion: 1.1.0
tillerVersion: ">=2.7.2"
description: Helm chart for mixer deployment
keywords:
  - istio
  - mixer
sources:
  - http://github.com/istio/istio
engine: gotpl
icon: https://istio.io/favicons/android-192x192.png
`)

func chartsIstioTelemetryMixerTelemetryChartYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryMixerTelemetryChartYaml, nil
}

func chartsIstioTelemetryMixerTelemetryChartYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryMixerTelemetryChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/mixer-telemetry/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryMixerTelemetryTemplates_affinityTpl = []byte(`{{/* affinity - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ */}}

{{- define "nodeaffinity" }}
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityRequiredDuringScheduling" . }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityPreferredDuringScheduling" . }}
{{- end }}

{{- define "nodeAffinityRequiredDuringScheduling" }}
      nodeSelectorTerms:
      - matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
        {{- range $key, $val := .Values.global.arch }}
          {{- if gt ($val | int) 0 }}
          - {{ $key | quote }}
          {{- end }}
        {{- end }}
        {{- $nodeSelector := default .Values.global.defaultNodeSelector .Values.mixer.telemetry.nodeSelector -}}
        {{- range $key, $val := $nodeSelector }}
        - key: {{ $key }}
          operator: In
          values:
          - {{ $val | quote }}
        {{- end }}
{{- end }}

{{- define "nodeAffinityPreferredDuringScheduling" }}
  {{- range $key, $val := .Values.global.arch }}
    {{- if gt ($val | int) 0 }}
    - weight: {{ $val | int }}
      preference:
        matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
          - {{ $key | quote }}
    {{- end }}
  {{- end }}
{{- end }}

{{- define "podAntiAffinity" }}
{{- if or .Values.mixer.telemetry.podAntiAffinityLabelSelector .Values.mixer.telemetry.podAntiAffinityTermLabelSelector}}
  podAntiAffinity:
    {{- if .Values.mixer.telemetry.podAntiAffinityLabelSelector }}
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityRequiredDuringScheduling" . }}
    {{- end }}
    {{- if .Values.mixer.telemetry.podAntiAffinityTermLabelSelector }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityPreferredDuringScheduling" . }}
    {{- end }}
{{- end }}
{{- end }}

{{- define "podAntiAffinityRequiredDuringScheduling" }}
    {{- range $index, $item := .Values.mixer.telemetry.podAntiAffinityLabelSelector }}
    - labelSelector:
        matchExpressions:
        - key: {{ $item.key }}
          operator: {{ $item.operator }}
          {{- if $item.values }}
          values:
          {{- $vals := split "," $item.values }}
          {{- range $i, $v := $vals }}
          - {{ $v | quote }}
          {{- end }}
          {{- end }}
      topologyKey: {{ $item.topologyKey }}
    {{- end }}
{{- end }}

{{- define "podAntiAffinityPreferredDuringScheduling" }}
    {{- range $index, $item := .Values.mixer.telemetry.podAntiAffinityTermLabelSelector }}
    - podAffinityTerm:
        labelSelector:
          matchExpressions:
          - key: {{ $item.key }}
            operator: {{ $item.operator }}
            {{- if $item.values }}
            values:
            {{- $vals := split "," $item.values }}
            {{- range $i, $v := $vals }}
            - {{ $v | quote }}
            {{- end }}
            {{- end }}
        topologyKey: {{ $item.topologyKey }}
      weight: 100
    {{- end }}
{{- end }}
`)

func chartsIstioTelemetryMixerTelemetryTemplates_affinityTplBytes() ([]byte, error) {
	return _chartsIstioTelemetryMixerTelemetryTemplates_affinityTpl, nil
}

func chartsIstioTelemetryMixerTelemetryTemplates_affinityTpl() (*asset, error) {
	bytes, err := chartsIstioTelemetryMixerTelemetryTemplates_affinityTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/mixer-telemetry/templates/_affinity.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryMixerTelemetryTemplatesAutoscaleYaml = []byte(`{{ $telemetry := index .Values "mixer" "telemetry" }}
{{- if and $telemetry.autoscaleEnabled $telemetry.autoscaleMin $telemetry.autoscaleMax }}
apiVersion: autoscaling/v2beta1
kind: HorizontalPodAutoscaler
metadata:
  name: istio-telemetry
  namespace: {{ .Release.Namespace }}
  labels:
    app: mixer
    release: {{ .Release.Name }}
spec:
    maxReplicas: {{ $telemetry.autoscaleMax }}
    minReplicas: {{ $telemetry.autoscaleMin }}
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: istio-telemetry
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageUtilization: {{ $telemetry.cpu.targetAverageUtilization }}
---
{{- end }}
`)

func chartsIstioTelemetryMixerTelemetryTemplatesAutoscaleYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryMixerTelemetryTemplatesAutoscaleYaml, nil
}

func chartsIstioTelemetryMixerTelemetryTemplatesAutoscaleYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryMixerTelemetryTemplatesAutoscaleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/mixer-telemetry/templates/autoscale.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryMixerTelemetryTemplatesClusterroleYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-mixer-{{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
rules:
- apiGroups: ["config.istio.io"] # istio CRD watcher
  resources: ["*"]
  verbs: ["create", "get", "list", "watch", "patch"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["configmaps", "endpoints", "pods", "services", "namespaces", "secrets", "replicationcontrollers"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["extensions", "apps"]
  resources: ["replicasets"]
  verbs: ["get", "list", "watch"]
---
`)

func chartsIstioTelemetryMixerTelemetryTemplatesClusterroleYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryMixerTelemetryTemplatesClusterroleYaml, nil
}

func chartsIstioTelemetryMixerTelemetryTemplatesClusterroleYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryMixerTelemetryTemplatesClusterroleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/mixer-telemetry/templates/clusterrole.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryMixerTelemetryTemplatesClusterrolebindingYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-mixer-admin-role-binding-{{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istio-mixer-{{ .Release.Namespace }}
subjects:
  - kind: ServiceAccount
    name: istio-mixer-service-account
    namespace: {{ .Release.Namespace }}
---
`)

func chartsIstioTelemetryMixerTelemetryTemplatesClusterrolebindingYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryMixerTelemetryTemplatesClusterrolebindingYaml, nil
}

func chartsIstioTelemetryMixerTelemetryTemplatesClusterrolebindingYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryMixerTelemetryTemplatesClusterrolebindingYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/mixer-telemetry/templates/clusterrolebinding.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryMixerTelemetryTemplatesConfigYaml = []byte(`apiVersion: "config.istio.io/v1alpha2"
kind: attributemanifest
metadata:
  name: istioproxy
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  attributes:
    origin.ip:
      valueType: IP_ADDRESS
    origin.uid:
      valueType: STRING
    origin.user:
      valueType: STRING
    request.headers:
      valueType: STRING_MAP
    request.id:
      valueType: STRING
    request.host:
      valueType: STRING
    request.method:
      valueType: STRING
    request.path:
      valueType: STRING
    request.url_path:
      valueType: STRING
    request.query_params:
      valueType: STRING_MAP
    request.reason:
      valueType: STRING
    request.referer:
      valueType: STRING
    request.scheme:
      valueType: STRING
    request.total_size:
      valueType: INT64
    request.size:
      valueType: INT64
    request.time:
      valueType: TIMESTAMP
    request.useragent:
      valueType: STRING
    response.code:
      valueType: INT64
    response.duration:
      valueType: DURATION
    response.headers:
      valueType: STRING_MAP
    response.total_size:
      valueType: INT64
    response.size:
      valueType: INT64
    response.time:
      valueType: TIMESTAMP
    response.grpc_status:
      valueType: STRING
    response.grpc_message:
      valueType: STRING
    source.uid:
      valueType: STRING
    source.user: # DEPRECATED
      valueType: STRING
    source.principal:
      valueType: STRING
    destination.uid:
      valueType: STRING
    destination.principal:
      valueType: STRING
    destination.port:
      valueType: INT64
    connection.event:
      valueType: STRING
    connection.id:
      valueType: STRING
    connection.received.bytes:
      valueType: INT64
    connection.received.bytes_total:
      valueType: INT64
    connection.sent.bytes:
      valueType: INT64
    connection.sent.bytes_total:
      valueType: INT64
    connection.duration:
      valueType: DURATION
    connection.mtls:
      valueType: BOOL
    connection.requested_server_name:
      valueType: STRING
    context.protocol:
      valueType: STRING
    context.proxy_error_code:
      valueType: STRING
    context.timestamp:
      valueType: TIMESTAMP
    context.time:
      valueType: TIMESTAMP
    # Deprecated, kept for compatibility
    context.reporter.local:
      valueType: BOOL
    context.reporter.kind:
      valueType: STRING
    context.reporter.uid:
      valueType: STRING
    context.proxy_version:
      valueType: STRING
    api.service:
      valueType: STRING
    api.version:
      valueType: STRING
    api.operation:
      valueType: STRING
    api.protocol:
      valueType: STRING
    request.auth.principal:
      valueType: STRING
    request.auth.audiences:
      valueType: STRING
    request.auth.presenter:
      valueType: STRING
    request.auth.claims:
      valueType: STRING_MAP
    request.auth.raw_claims:
      valueType: STRING
    request.api_key:
      valueType: STRING
    rbac.permissive.response_code:
      valueType: STRING
    rbac.permissive.effective_policy_id:
      valueType: STRING
    check.error_code:
      valueType: INT64
    check.error_message:
      valueType: STRING
    check.cache_hit:
      valueType: BOOL
    quota.cache_hit:
      valueType: BOOL

---
apiVersion: "config.istio.io/v1alpha2"
kind: attributemanifest
metadata:
  name: kubernetes
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  attributes:
    source.ip:
      valueType: IP_ADDRESS
    source.labels:
      valueType: STRING_MAP
    source.metadata:
      valueType: STRING_MAP
    source.name:
      valueType: STRING
    source.namespace:
      valueType: STRING
    source.owner:
      valueType: STRING
    source.serviceAccount:
      valueType: STRING
    source.services:
      valueType: STRING
    source.workload.uid:
      valueType: STRING
    source.workload.name:
      valueType: STRING
    source.workload.namespace:
      valueType: STRING
    destination.ip:
      valueType: IP_ADDRESS
    destination.labels:
      valueType: STRING_MAP
    destination.metadata:
      valueType: STRING_MAP
    destination.owner:
      valueType: STRING
    destination.name:
      valueType: STRING
    destination.container.name:
      valueType: STRING
    destination.namespace:
      valueType: STRING
    destination.service.uid:
      valueType: STRING
    destination.service.name:
      valueType: STRING
    destination.service.namespace:
      valueType: STRING
    destination.service.host:
      valueType: STRING
    destination.serviceAccount:
      valueType: STRING
    destination.workload.uid:
      valueType: STRING
    destination.workload.name:
      valueType: STRING
    destination.workload.namespace:
      valueType: STRING
---
{{- if .Values.mixer.adapters.stdio.enabled }}
apiVersion: "config.istio.io/v1alpha2"
kind: handler
metadata:
  name: stdio
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledAdapter: stdio
  params:
    outputAsJson: {{ .Values.mixer.adapters.stdio.outputAsJson }}
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: accesslog
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: logentry
  params:
    severity: '"Info"'
    timestamp: request.time
    variables:
      sourceIp: source.ip | ip("0.0.0.0")
      sourceApp: source.labels["app"] | ""
      sourcePrincipal: source.principal | ""
      sourceName: source.name | ""
      sourceWorkload: source.workload.name | ""
      sourceNamespace: source.namespace | ""
      sourceOwner: source.owner | ""
      destinationApp: destination.labels["app"] | ""
      destinationIp: destination.ip | ip("0.0.0.0")
      destinationServiceHost: destination.service.host | request.host | ""
      destinationWorkload: destination.workload.name | ""
      destinationName: destination.name | ""
      destinationNamespace: destination.namespace | ""
      destinationOwner: destination.owner | ""
      destinationPrincipal: destination.principal | ""
      apiClaims: request.auth.raw_claims | ""
      apiKey: request.api_key | request.headers["x-api-key"] | ""
      protocol: api.protocol | context.protocol | "http"
      method: request.method | ""
      url: request.path | ""
      responseCode: response.code | 0
      responseFlags: context.proxy_error_code | ""
      responseSize: response.size | 0
      permissiveResponseCode: rbac.permissive.response_code | "none"
      permissiveResponsePolicyID: rbac.permissive.effective_policy_id | "none"
      requestSize: request.size | 0
      requestId: request.headers["x-request-id"] | ""
      clientTraceId: request.headers["x-client-trace-id"] | ""
      latency: response.duration | "0ms"
      connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      requestedServerName: connection.requested_server_name | ""
      userAgent: request.useragent | ""
      responseTimestamp: response.time
      receivedBytes: request.total_size | 0
      sentBytes: response.total_size | 0
      referer: request.referer | ""
      httpAuthority: request.headers[":authority"] | request.host | ""
      xForwardedFor: request.headers["x-forwarded-for"] | "0.0.0.0"
      reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
      grpcStatus: response.grpc_status | ""
      grpcMessage: response.grpc_message | ""
    monitored_resource_type: '"global"'
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: tcpaccesslog
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: logentry
  params:
    severity: '"Info"'
    timestamp: context.time | timestamp("2017-01-01T00:00:00Z")
    variables:
      connectionEvent: connection.event | ""
      sourceIp: source.ip | ip("0.0.0.0")
      sourceApp: source.labels["app"] | ""
      sourcePrincipal: source.principal | ""
      sourceName: source.name | ""
      sourceWorkload: source.workload.name | ""
      sourceNamespace: source.namespace | ""
      sourceOwner: source.owner | ""
      destinationApp: destination.labels["app"] | ""
      destinationIp: destination.ip | ip("0.0.0.0")
      destinationServiceHost: destination.service.host | ""
      destinationWorkload: destination.workload.name | ""
      destinationName: destination.name | ""
      destinationNamespace: destination.namespace | ""
      destinationOwner: destination.owner | ""
      destinationPrincipal: destination.principal | ""
      protocol: context.protocol | "tcp"
      connectionDuration: connection.duration | "0ms"
      connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      requestedServerName: connection.requested_server_name | ""
      receivedBytes: connection.received.bytes | 0
      sentBytes: connection.sent.bytes | 0
      totalReceivedBytes: connection.received.bytes_total | 0
      totalSentBytes: connection.sent.bytes_total | 0
      reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
      responseFlags: context.proxy_error_code | ""
    monitored_resource_type: '"global"'
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: stdio
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  match: context.protocol == "http" || context.protocol == "grpc"
  actions:
  - handler: stdio
    instances:
    - accesslog
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: stdiotcp
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  match: context.protocol == "tcp"
  actions:
  - handler: stdio
    instances:
    - tcpaccesslog
{{- end }}
---
{{- if .Values.mixer.adapters.prometheus.enabled }}
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: requestcount
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: "1"
    dimensions:
      reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
      source_workload: source.workload.name | "unknown"
      source_workload_namespace: source.workload.namespace | "unknown"
      source_principal: source.principal | "unknown"
      source_app: source.labels["app"] | "unknown"
      source_version: source.labels["version"] | "unknown"
      destination_workload: destination.workload.name | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_principal: destination.principal | "unknown"
      destination_app: destination.labels["app"] | "unknown"
      destination_version: destination.labels["version"] | "unknown"
      destination_service: destination.service.host | conditional((destination.service.name | "unknown") == "unknown", "unknown", request.host)
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      request_protocol: api.protocol | context.protocol | "unknown"
      response_code: response.code | 200
      grpc_response_status: response.grpc_status | ""
      response_flags: context.proxy_error_code | "-"
      connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
    monitored_resource_type: '"UNSPECIFIED"'
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: requestduration
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: response.duration | "0ms"
    dimensions:
      reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
      source_workload: source.workload.name | "unknown"
      source_workload_namespace: source.workload.namespace | "unknown"
      source_principal: source.principal | "unknown"
      source_app: source.labels["app"] | "unknown"
      source_version: source.labels["version"] | "unknown"
      destination_workload: destination.workload.name | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_principal: destination.principal | "unknown"
      destination_app: destination.labels["app"] | "unknown"
      destination_version: destination.labels["version"] | "unknown"
      destination_service: destination.service.host | conditional((destination.service.name | "unknown") == "unknown", "unknown", request.host)
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      request_protocol: api.protocol | context.protocol | "unknown"
      response_code: response.code | 200
      grpc_response_status: response.grpc_status | ""
      response_flags: context.proxy_error_code | "-"
      connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
    monitored_resource_type: '"UNSPECIFIED"'
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: requestsize
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: request.size | 0
    dimensions:
      reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
      source_workload: source.workload.name | "unknown"
      source_workload_namespace: source.workload.namespace | "unknown"
      source_principal: source.principal | "unknown"
      source_app: source.labels["app"] | "unknown"
      source_version: source.labels["version"] | "unknown"
      destination_workload: destination.workload.name | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_principal: destination.principal | "unknown"
      destination_app: destination.labels["app"] | "unknown"
      destination_version: destination.labels["version"] | "unknown"
      destination_service: destination.service.host | conditional((destination.service.name | "unknown") == "unknown", "unknown", request.host)
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      request_protocol: api.protocol | context.protocol | "unknown"
      response_code: response.code | 200
      grpc_response_status: response.grpc_status | ""
      response_flags: context.proxy_error_code | "-"
      connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
    monitored_resource_type: '"UNSPECIFIED"'
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: responsesize
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: response.size | 0
    dimensions:
      reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
      source_workload: source.workload.name | "unknown"
      source_workload_namespace: source.workload.namespace | "unknown"
      source_principal: source.principal | "unknown"
      source_app: source.labels["app"] | "unknown"
      source_version: source.labels["version"] | "unknown"
      destination_workload: destination.workload.name | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_principal: destination.principal | "unknown"
      destination_app: destination.labels["app"] | "unknown"
      destination_version: destination.labels["version"] | "unknown"
      destination_service: destination.service.host | conditional((destination.service.name | "unknown") == "unknown", "unknown", request.host)
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      request_protocol: api.protocol | context.protocol | "unknown"
      response_code: response.code | 200
      grpc_response_status: response.grpc_status | ""
      response_flags: context.proxy_error_code | "-"
      connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
    monitored_resource_type: '"UNSPECIFIED"'
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: tcpbytesent
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: connection.sent.bytes | 0
    dimensions:
      reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
      source_workload: source.workload.name | "unknown"
      source_workload_namespace: source.workload.namespace | "unknown"
      source_principal: source.principal | "unknown"
      source_app: source.labels["app"] | "unknown"
      source_version: source.labels["version"] | "unknown"
      destination_workload: destination.workload.name | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_principal: destination.principal | "unknown"
      destination_app: destination.labels["app"] | "unknown"
      destination_version: destination.labels["version"] | "unknown"
      destination_service: destination.service.host | "unknown"
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      response_flags: context.proxy_error_code | "-"
    monitored_resource_type: '"UNSPECIFIED"'
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: tcpbytereceived
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: connection.received.bytes | 0
    dimensions:
      reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
      source_workload: source.workload.name | "unknown"
      source_workload_namespace: source.workload.namespace | "unknown"
      source_principal: source.principal | "unknown"
      source_app: source.labels["app"] | "unknown"
      source_version: source.labels["version"] | "unknown"
      destination_workload: destination.workload.name | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_principal: destination.principal | "unknown"
      destination_app: destination.labels["app"] | "unknown"
      destination_version: destination.labels["version"] | "unknown"
      destination_service: destination.service.host | "unknown"
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      response_flags: context.proxy_error_code | "-"
    monitored_resource_type: '"UNSPECIFIED"'
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: tcpconnectionsopened
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: "1"
    dimensions:
      reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
      source_workload: source.workload.name | "unknown"
      source_workload_namespace: source.workload.namespace | "unknown"
      source_principal: source.principal | "unknown"
      source_app: source.labels["app"] | "unknown"
      source_version: source.labels["version"] | "unknown"
      destination_workload: destination.workload.name | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_principal: destination.principal | "unknown"
      destination_app: destination.labels["app"] | "unknown"
      destination_version: destination.labels["version"] | "unknown"
      destination_service: destination.service.host | "unknown"
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      response_flags: context.proxy_error_code | "-"
    monitored_resource_type: '"UNSPECIFIED"'
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: tcpconnectionsclosed
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: "1"
    dimensions:
      reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
      source_workload: source.workload.name | "unknown"
      source_workload_namespace: source.workload.namespace | "unknown"
      source_principal: source.principal | "unknown"
      source_app: source.labels["app"] | "unknown"
      source_version: source.labels["version"] | "unknown"
      destination_workload: destination.workload.name | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_principal: destination.principal | "unknown"
      destination_app: destination.labels["app"] | "unknown"
      destination_version: destination.labels["version"] | "unknown"
      destination_service: destination.service.host | "unknown"
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      response_flags: context.proxy_error_code | "-"
    monitored_resource_type: '"UNSPECIFIED"'
---
apiVersion: "config.istio.io/v1alpha2"
kind: handler
metadata:
  name: prometheus
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledAdapter: prometheus
  params:
    metricsExpirationPolicy:
      metricsExpiryDuration: "{{ .Values.mixer.adapters.prometheus.metricsExpiryDuration }}"
    metrics:
    - name: requests_total
      instance_name: requestcount.instance.{{ .Release.Namespace }}
      kind: COUNTER
      label_names:
      - reporter
      - source_app
      - source_principal
      - source_workload
      - source_workload_namespace
      - source_version
      - destination_app
      - destination_principal
      - destination_workload
      - destination_workload_namespace
      - destination_version
      - destination_service
      - destination_service_name
      - destination_service_namespace
      - request_protocol
      - grpc_response_status
      - response_code
      - response_flags
      - connection_security_policy
    - name: request_duration_seconds
      instance_name: requestduration.instance.{{ .Release.Namespace }}
      kind: DISTRIBUTION
      label_names:
      - reporter
      - source_app
      - source_principal
      - source_workload
      - source_workload_namespace
      - source_version
      - destination_app
      - destination_principal
      - destination_workload
      - destination_workload_namespace
      - destination_version
      - destination_service
      - destination_service_name
      - destination_service_namespace
      - request_protocol
      - response_code
      - grpc_response_status
      - response_flags
      - connection_security_policy
      buckets:
        explicit_buckets:
          bounds: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10]
    - name: request_bytes
      instance_name: requestsize.instance.{{ .Release.Namespace }}
      kind: DISTRIBUTION
      label_names:
      - reporter
      - source_app
      - source_principal
      - source_workload
      - source_workload_namespace
      - source_version
      - destination_app
      - destination_principal
      - destination_workload
      - destination_workload_namespace
      - destination_version
      - destination_service
      - destination_service_name
      - destination_service_namespace
      - request_protocol
      - response_code
      - grpc_response_status
      - response_flags
      - connection_security_policy
      buckets:
        exponentialBuckets:
          numFiniteBuckets: 8
          scale: 1
          growthFactor: 10
    - name: response_bytes
      instance_name: responsesize.instance.{{ .Release.Namespace }}
      kind: DISTRIBUTION
      label_names:
      - reporter
      - source_app
      - source_principal
      - source_workload
      - source_workload_namespace
      - source_version
      - destination_app
      - destination_principal
      - destination_workload
      - destination_workload_namespace
      - destination_version
      - destination_service
      - destination_service_name
      - destination_service_namespace
      - request_protocol
      - response_code
      - grpc_response_status
      - response_flags
      - connection_security_policy
      buckets:
        exponentialBuckets:
          numFiniteBuckets: 8
          scale: 1
          growthFactor: 10
    - name: tcp_sent_bytes_total
      instance_name: tcpbytesent.instance.{{ .Release.Namespace }}
      kind: COUNTER
      label_names:
      - reporter
      - source_app
      - source_principal
      - source_workload
      - source_workload_namespace
      - source_version
      - destination_app
      - destination_principal
      - destination_workload
      - destination_workload_namespace
      - destination_version
      - destination_service
      - destination_service_name
      - destination_service_namespace
      - connection_security_policy
      - response_flags
    - name: tcp_received_bytes_total
      instance_name: tcpbytereceived.instance.{{ .Release.Namespace }}
      kind: COUNTER
      label_names:
      - reporter
      - source_app
      - source_principal
      - source_workload
      - source_workload_namespace
      - source_version
      - destination_app
      - destination_principal
      - destination_workload
      - destination_workload_namespace
      - destination_version
      - destination_service
      - destination_service_name
      - destination_service_namespace
      - connection_security_policy
      - response_flags
    - name: tcp_connections_opened_total
      instance_name: tcpconnectionsopened.instance.{{ .Release.Namespace }}
      kind: COUNTER
      label_names:
      - reporter
      - source_app
      - source_principal
      - source_workload
      - source_workload_namespace
      - source_version
      - destination_app
      - destination_principal
      - destination_workload
      - destination_workload_namespace
      - destination_version
      - destination_service
      - destination_service_name
      - destination_service_namespace
      - connection_security_policy
      - response_flags
    - name: tcp_connections_closed_total
      instance_name: tcpconnectionsclosed.instance.{{ .Release.Namespace }}
      kind: COUNTER
      label_names:
      - reporter
      - source_app
      - source_principal
      - source_workload
      - source_workload_namespace
      - source_version
      - destination_app
      - destination_principal
      - destination_workload
      - destination_workload_namespace
      - destination_version
      - destination_service
      - destination_service_name
      - destination_service_namespace
      - connection_security_policy
      - response_flags
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: promhttp
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  match: (context.protocol == "http" || context.protocol == "grpc") && (match((request.useragent | "-"), "kube-probe*") == false) && (match((request.useragent | "-"), "Prometheus*") == false)
  actions:
  - handler: prometheus
    instances:
    - requestcount
    - requestduration
    - requestsize
    - responsesize
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: promtcp
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  match: context.protocol == "tcp"
  actions:
  - handler: prometheus
    instances:
    - tcpbytesent
    - tcpbytereceived
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: promtcpconnectionopen
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  match: context.protocol == "tcp" && ((connection.event | "na") == "open")
  actions:
  - handler: prometheus
    instances:
    - tcpconnectionsopened
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: promtcpconnectionclosed
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  match: context.protocol == "tcp" && ((connection.event | "na") == "close")
  actions:
  - handler: prometheus
    instances:
    - tcpconnectionsclosed
{{- end }}
---
{{- if .Values.mixer.adapters.kubernetesenv.enabled }}
apiVersion: "config.istio.io/v1alpha2"
kind: handler
metadata:
  name: kubernetesenv
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledAdapter: kubernetesenv
  params: {}
    # when running from mixer root, use the following config after adding a
    # symbolic link to a kubernetes config file via:
    #
    # $ ln -s ~/.kube/config mixer/adapter/kubernetes/kubeconfig
    #
    # kubeconfig_path: "mixer/adapter/kubernetes/kubeconfig"

---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: kubeattrgenrulerule
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  actions:
  - handler: kubernetesenv
    instances:
    - attributes
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: tcpkubeattrgenrulerule
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  match: context.protocol == "tcp"
  actions:
  - handler: kubernetesenv
    instances:
    - attributes
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: attributes
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: kubernetes
  params:
    # Pass the required attribute data to the adapter
    source_uid: source.uid | ""
    source_ip: source.ip | ip("0.0.0.0") # default to unspecified ip addr
    destination_uid: destination.uid | ""
    destination_port: destination.port | 0
  attributeBindings:
    # Fill the new attributes from the adapter produced output.
    # $out refers to an instance of OutputTemplate message
    source.ip: $out.source_pod_ip | ip("0.0.0.0")
    source.uid: $out.source_pod_uid | "unknown"
    source.labels: $out.source_labels | emptyStringMap()
    source.name: $out.source_pod_name | "unknown"
    source.namespace: $out.source_namespace | "default"
    source.owner: $out.source_owner | "unknown"
    source.serviceAccount: $out.source_service_account_name | "unknown"
    source.workload.uid: $out.source_workload_uid | "unknown"
    source.workload.name: $out.source_workload_name | "unknown"
    source.workload.namespace: $out.source_workload_namespace | "unknown"
    destination.ip: $out.destination_pod_ip | ip("0.0.0.0")
    destination.uid: $out.destination_pod_uid | "unknown"
    destination.labels: $out.destination_labels | emptyStringMap()
    destination.name: $out.destination_pod_name | "unknown"
    destination.container.name: $out.destination_container_name | "unknown"
    destination.namespace: $out.destination_namespace | "default"
    destination.owner: $out.destination_owner | "unknown"
    destination.serviceAccount: $out.destination_service_account_name | "unknown"
    destination.workload.uid: $out.destination_workload_uid | "unknown"
    destination.workload.name: $out.destination_workload_name | "unknown"
    destination.workload.namespace: $out.destination_workload_namespace | "unknown"
{{- end }}
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: istio-telemetry
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  host: istio-telemetry.{{ .Release.Namespace }}.svc.{{ .Values.global.proxy.clusterDomain }}
  {{- if .Values.global.defaultConfigVisibilitySettings }}
  exportTo:
  - '*'
  {{- end }}
  trafficPolicy:
    portLevelSettings:
    - port:
        number: 15004 # grpc-mixer-mtls
      tls:
        mode: ISTIO_MUTUAL
    - port:
        number: 9091 # grpc-mixer
      tls:
        mode: DISABLE
    connectionPool:
      http:
        http2MaxRequests: 10000
        maxRequestsPerConnection: 10000
---
`)

func chartsIstioTelemetryMixerTelemetryTemplatesConfigYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryMixerTelemetryTemplatesConfigYaml, nil
}

func chartsIstioTelemetryMixerTelemetryTemplatesConfigYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryMixerTelemetryTemplatesConfigYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/mixer-telemetry/templates/config.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryMixerTelemetryTemplatesConfigmapEnvoyYaml = []byte(`apiVersion: v1
kind: ConfigMap
metadata:
  namespace: {{ .Release.Namespace }}
  name: telemetry-envoy-config
  labels:
    release: {{ .Release.Name }}
data:
  # Explicitly defined - moved from istio/istio/pilot/docker.
  envoy.yaml.tmpl: |-
    admin:
      access_log_path: /dev/null
      address:
        socket_address:
          address: 127.0.0.1
          port_value: 15000
    stats_config:
      use_all_default_tags: false
      stats_tags:
      - tag_name: cluster_name
        regex: '^cluster\.((.+?(\..+?\.svc\.cluster\.local)?)\.)'
      - tag_name: tcp_prefix
        regex: '^tcp\.((.*?)\.)\w+?$'
      - tag_name: response_code
        regex: '_rq(_(\d{3}))$'
      - tag_name: response_code_class
        regex: '_rq(_(\dxx))$'
      - tag_name: http_conn_manager_listener_prefix
        regex: '^listener(?=\.).*?\.http\.(((?:[_.[:digit:]]*|[_\[\]aAbBcCdDeEfF[:digit:]]*))\.)'
      - tag_name: http_conn_manager_prefix
        regex: '^http\.(((?:[_.[:digit:]]*|[_\[\]aAbBcCdDeEfF[:digit:]]*))\.)'
      - tag_name: listener_address
        regex: '^listener\.(((?:[_.[:digit:]]*|[_\[\]aAbBcCdDeEfF[:digit:]]*))\.)'

    static_resources:
      clusters:
      - name: prometheus_stats
        type: STATIC
        connect_timeout: 0.250s
        lb_policy: ROUND_ROBIN
        hosts:
        - socket_address:
            protocol: TCP
            address: 127.0.0.1
            port_value: 15000

      - name: inbound_9092
        circuit_breakers:
          thresholds:
          - max_connections: 100000
            max_pending_requests: 100000
            max_requests: 100000
            max_retries: 3
        connect_timeout: 1.000s
        hosts:
        - pipe:
            path: /sock/mixer.socket
        http2_protocol_options: {}

      - name: out.galley.15019
        http2_protocol_options: {}
        connect_timeout: 1.000s
        type: STRICT_DNS

        circuit_breakers:
          thresholds:
            - max_connections: 100000
              max_pending_requests: 100000
              max_requests: 100000
              max_retries: 3

        tls_context:
          common_tls_context:
            tls_certificates:
            - certificate_chain:
                filename: /etc/certs/cert-chain.pem
              private_key:
                filename: /etc/certs/key.pem
            validation_context:
              trusted_ca:
                filename: /etc/certs/root-cert.pem
              verify_subject_alt_name:
              - spiffe://{{ .Values.global.trustDomain }}/ns/{{ .Values.global.configNamespace }}/sa/istio-galley-service-account

        hosts:
          - socket_address:
              address: istio-galley.{{ .Values.global.configNamespace }}
              port_value: 15019


      listeners:
      - name: "15090"
        address:
          socket_address:
            protocol: TCP
            address: 0.0.0.0
            port_value: 15090
        filter_chains:
        - filters:
          - name: envoy.http_connection_manager
            config:
              codec_type: AUTO
              stat_prefix: stats
              route_config:
                virtual_hosts:
                - name: backend
                  domains:
                  - '*'
                  routes:
                  - match:
                      prefix: /stats/prometheus
                    route:
                      cluster: prometheus_stats
              http_filters:
              - name: envoy.router

      - name: "15004"
        address:
          socket_address:
            address: 0.0.0.0
            port_value: 15004
        filter_chains:
        - filters:
          - config:
              codec_type: HTTP2
              http2_protocol_options:
                max_concurrent_streams: 1073741824
              generate_request_id: true
              http_filters:
              - config:
                  default_destination_service: istio-telemetry.{{ .Release.Namespace }}.svc.{{ .Values.global.proxy.clusterDomain }}
                  service_configs:
                    istio-telemetry.{{ .Release.Namespace }}.svc.{{ .Values.global.proxy.clusterDomain }}:
                      disable_check_calls: true
    {{"{{"}}- if .DisableReportCalls {{"}}"}}
                      disable_report_calls: true
    {{"{{"}}- end {{"}}"}}
                      mixer_attributes:
                        attributes:
                          destination.service.host:
                            string_value: istio-telemetry.{{ .Release.Namespace }}.svc.{{ .Values.global.proxy.clusterDomain }}
                          destination.service.uid:
                            string_value: istio://{{ .Release.Namespace }}/services/istio-telemetry
                          destination.service.name:
                            string_value: istio-telemetry
                          destination.service.namespace:
                            string_value: {{ .Release.Namespace }}
                          destination.uid:
                            string_value: kubernetes://{{"{{"}} .PodName {{"}}"}}.{{ .Release.Namespace }}
                          destination.namespace:
                            string_value: {{.Release.Namespace }}
                          destination.ip:
                            bytes_value: {{"{{"}} .PodIP {{"}}"}}
                          destination.port:
                            int64_value: 15004
                          context.reporter.kind:
                            string_value: inbound
                          context.reporter.uid:
                            string_value: kubernetes://{{"{{"}} .PodName {{"}}"}}.{{ .Release.Namespace }}
                  transport:
                    check_cluster: mixer_check_server
                    report_cluster: inbound_9092
                name: mixer
              - name: envoy.router
              route_config:
                name: "15004"
                virtual_hosts:
                - domains:
                  - '*'
                  name: istio-telemetry.{{ .Release.Namespace }}.svc.{{ .Values.global.proxy.clusterDomain }}
                  routes:
                  - decorator:
                      operation: Report
                    match:
                      prefix: /
                    route:
                      cluster: inbound_9092
                      timeout: 0.000s
              stat_prefix: "15004"
            name: envoy.http_connection_manager
    {{- if .Values.global.controlPlaneSecurityEnabled }}
          tls_context:
            common_tls_context:
              alpn_protocols:
              - h2
              tls_certificates:
              - certificate_chain:
                  filename: /etc/certs/cert-chain.pem
                private_key:
                  filename: /etc/certs/key.pem
              validation_context:
                trusted_ca:
                  filename: /etc/certs/root-cert.pem
            require_client_certificate: true
    {{- end }}

      - name: "9091"
        address:
          socket_address:
            address: 0.0.0.0
            port_value: 9091
        filter_chains:
        - filters:
          - config:
              codec_type: HTTP2
              http2_protocol_options:
                max_concurrent_streams: 1073741824
              generate_request_id: true
              http_filters:
              - config:
                  default_destination_service: istio-telemetry.{{ .Release.Namespace }}.svc.{{ .Values.global.proxy.clusterDomain }}
                  service_configs:
                    istio-telemetry.{{ .Release.Namespace }}.svc.{{ .Values.global.proxy.clusterDomain }}:
                      disable_check_calls: true
    {{"{{"}}- if .DisableReportCalls {{"}}"}}
                      disable_report_calls: true
    {{"{{"}}- end {{"}}"}}
                      mixer_attributes:
                        attributes:
                          destination.service.host:
                            string_value: istio-telemetry.{{ .Release.Namespace }}.svc.{{ .Values.global.proxy.clusterDomain }}
                          destination.service.uid:
                            string_value: istio://{{ .Release.Namespace }}/services/istio-telemetry
                          destination.service.name:
                            string_value: istio-telemetry
                          destination.service.namespace:
                            string_value: {{ .Release.Namespace }}
                          destination.uid:
                            string_value: kubernetes://{{"{{"}} .PodName {{"}}"}}.{{ .Release.Namespace }}
                          destination.namespace:
                            string_value: {{.Release.Namespace }}
                          destination.ip:
                            bytes_value: {{"{{"}} .PodIP {{"}}"}}
                          destination.port:
                            int64_value: 9091
                          context.reporter.kind:
                            string_value: inbound
                          context.reporter.uid:
                            string_value: kubernetes://{{"{{"}} .PodName {{"}}"}}.{{ .Release.Namespace }}
                  transport:
                    check_cluster: mixer_check_server
                    report_cluster: inbound_9092
                name: mixer
              - name: envoy.router
              route_config:
                name: "9091"
                virtual_hosts:
                - domains:
                  - '*'
                  name: istio-telemetry.{{ .Release.Namespace }}.svc.{{ .Values.global.proxy.clusterDomain }}
                  routes:
                  - decorator:
                      operation: Report
                    match:
                      prefix: /
                    route:
                      cluster: inbound_9092
                      timeout: 0.000s
              stat_prefix: "9091"
            name: envoy.http_connection_manager

      - name: "local.15019"
        address:
          socket_address:
            address: 127.0.0.1
            port_value: 15019
        filter_chains:
          - filters:
              - name: envoy.http_connection_manager
                config:
                  codec_type: HTTP2
                  stat_prefix: "15019"
                  stream_idle_timeout: 0s
                  http2_protocol_options:
                    max_concurrent_streams: 1073741824

                  access_log:
                    - name: envoy.file_access_log
                      config:
                        path: /dev/stdout

                  http_filters:
                    - name: envoy.router

                  route_config:
                    name: "15019"

                    virtual_hosts:
                      - name: istio-galley

                        domains:
                          - '*'

                        routes:
                          - match:
                              prefix: /
                            route:
                              cluster: out.galley.15019
                              timeout: 0.000s
---
`)

func chartsIstioTelemetryMixerTelemetryTemplatesConfigmapEnvoyYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryMixerTelemetryTemplatesConfigmapEnvoyYaml, nil
}

func chartsIstioTelemetryMixerTelemetryTemplatesConfigmapEnvoyYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryMixerTelemetryTemplatesConfigmapEnvoyYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/mixer-telemetry/templates/configmap-envoy.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryMixerTelemetryTemplatesDeploymentYaml = []byte(`apiVersion: apps/v1
kind: Deployment
metadata:
  name: istio-telemetry
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-mixer
    istio: mixer
    release: {{ .Release.Name }}
spec:
  replicas: {{ .Values.mixer.telemetry.replicaCount }}
  strategy:
    rollingUpdate:
      maxSurge: {{ .Values.mixer.telemetry.rollingMaxSurge }}
      maxUnavailable: {{ .Values.mixer.telemetry.rollingMaxUnavailable }}
  selector:
    matchLabels:
      istio: mixer
      istio-mixer-type: telemetry
  template:
    metadata:
      labels:
        app: telemetry
        istio: mixer
        istio-mixer-type: telemetry
      annotations:
        sidecar.istio.io/inject: "false"
{{- with .Values.mixer.telemetry.podAnnotations }}
{{ toYaml . | indent 8 }}
{{- end }}
    spec:
      serviceAccountName: istio-mixer-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      securityContext:
        fsGroup: 1337
      volumes:
      - name: istio-certs
        secret:
          secretName: istio.istio-mixer-service-account
          optional: true
      - name: uds-socket
        emptyDir: {}
      - name: telemetry-adapter-secret
        secret:
          secretName: telemetry-adapter-secret
          optional: true
      - name: telemetry-envoy-config
        configMap:
          name: telemetry-envoy-config
      affinity:
      {{- include "nodeaffinity" . | indent 6 }}
      {{- include "podAntiAffinity" . | indent 6 }}
{{- if .Values.mixer.telemetry.tolerations }}
      tolerations:
{{ toYaml .Values.mixer.telemetry.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}
      containers:
      - name: mixer
{{- if contains "/" .Values.mixer.telemetry.image }}
        image: "{{ .Values.mixer.telemetry.image }}"
{{- else }}
        image: "{{ .Values.mixer.telemetry.hub | default .Values.global.hub }}/{{ .Values.mixer.telemetry.image }}:{{ .Values.mixer.telemetry.tag | default .Values.global.tag }}"
{{- end }}
        imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
        ports:
        - containerPort: 9091
        - containerPort: 15014
        - containerPort: 42422
        args:
          - --monitoringPort=15014
          - --address
{{- if .Values.global.controlPlaneSecurityEnabled }}
          - unix:///sock/mixer.socket
{{- else }}
          - tcp://0.0.0.0:9091
{{- end }}
{{- if .Values.global.logging.level }}
          - --log_output_level={{ .Values.global.logging.level }}
{{- end}}
{{- if .Values.global.logAsJson }}
          - --log_as_json
{{- end }}
{{- if .Values.global.useMCP }}
    {{- if .Values.global.controlPlaneSecurityEnabled}}
          - --configStoreURL=mcp://localhost:15019
    {{- else }}
          - --configStoreURL=mcp://istio-galley.{{ .Values.global.configNamespace }}.svc:9901
    {{- end }}
{{- else }}
          - --configStoreURL=k8s://
{{- end }}
          - --configDefaultNamespace={{ .Values.global.telemetryNamespace }}
          {{- if .Values.mixer.adapters.useAdapterCRDs }}
          - --useAdapterCRDs=true
          {{- else }}
          - --useAdapterCRDs=false
          {{- end }}
          - --useTemplateCRDs=false
          {{- if .Values.global.tracer.zipkin.address }}
          - --trace_zipkin_url=http://{{- .Values.global.tracer.zipkin.address }}/api/v1/spans
          {{- else }}
          - --trace_zipkin_url=http://zipkin.{{ .Values.global.telemetryNamespace }}:9411/api/v1/spans
          {{- end }}
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        {{- if .Values.mixer.telemetry.env }}
        {{- range $key, $val := .Values.mixer.telemetry.env }}
        - name: {{ $key }}
          value: "{{ $val }}"
        {{- end }}
        {{- end }}
        resources:
{{- if .Values.mixer.telemetry.resources }}
{{ toYaml .Values.mixer.telemetry.resources | indent 10 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 10 }}
{{- end }}
        securityContext:
          runAsUser: 1337
          runAsGroup: 1337
          runAsNonRoot: true
          capabilities:
            drop:
            - ALL
        volumeMounts:
{{- if .Values.global.useMCP }}
        - name: istio-certs
          mountPath: /etc/certs
          readOnly: true
{{- end }}
        - name: uds-socket
          mountPath: /sock
        - name: telemetry-adapter-secret
          mountPath: /var/run/secrets/istio.io/telemetry/adapter
          readOnly: true
        livenessProbe:
          httpGet:
            path: /version
            port: 15014
          initialDelaySeconds: 5
          periodSeconds: 5
{{- if .Values.global.controlPlaneSecurityEnabled }}
      - name: istio-proxy
{{- if contains "/" .Values.global.proxy.image }}
        image: "{{ .Values.global.proxy.image }}"
{{- else }}
        image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}"
{{- end }}
        imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
        ports:
        - containerPort: 15004
        - containerPort: 15090
          protocol: TCP
          name: http-envoy-prom
        args:
        - proxy
        - --domain
        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
        - --serviceCluster
        - istio-telemetry
        - --templateFile
        - /var/lib/envoy/envoy.yaml.tmpl
      {{- if .Values.global.controlPlaneSecurityEnabled }}
        - --controlPlaneAuthPolicy
        - MUTUAL_TLS
      {{- else }}
        - --controlPlaneAuthPolicy
        - NONE
      {{- end }}
      {{- if .Values.global.trustDomain }}
        - --trust-domain={{ .Values.global.trustDomain }}
      {{- end }}
      {{- if .Values.global.logAsJson }}
        - --log_as_json
      {{- end }}
        env:
        - name: JWT_POLICY
          value: {{ .Values.global.jwtPolicy }}
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        resources:
{{- if .Values.global.proxy.resources }}
{{ toYaml .Values.global.proxy.resources | indent 10 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 10 }}
{{- end }}
        volumeMounts:
        - name: telemetry-envoy-config
          mountPath: /var/lib/envoy
        - name: istio-certs
          mountPath: /etc/certs
          readOnly: true
        - name: uds-socket
          mountPath: /sock
{{- end }}
---
`)

func chartsIstioTelemetryMixerTelemetryTemplatesDeploymentYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryMixerTelemetryTemplatesDeploymentYaml, nil
}

func chartsIstioTelemetryMixerTelemetryTemplatesDeploymentYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryMixerTelemetryTemplatesDeploymentYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/mixer-telemetry/templates/deployment.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryMixerTelemetryTemplatesPoddisruptionbudgetYaml = []byte(`{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: istio-telemetry
  namespace: {{ .Release.Namespace }}
  labels:
    app: telemetry
    release: {{ .Release.Name }}
    istio: mixer
    istio-mixer-type: telemetry
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app: telemetry
      istio: mixer
      istio-mixer-type: telemetry
---

{{- end }}
`)

func chartsIstioTelemetryMixerTelemetryTemplatesPoddisruptionbudgetYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryMixerTelemetryTemplatesPoddisruptionbudgetYaml, nil
}

func chartsIstioTelemetryMixerTelemetryTemplatesPoddisruptionbudgetYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryMixerTelemetryTemplatesPoddisruptionbudgetYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/mixer-telemetry/templates/poddisruptionbudget.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryMixerTelemetryTemplatesServiceYaml = []byte(`apiVersion: v1
kind: Service
metadata:
  name: istio-telemetry
  namespace: {{ .Release.Namespace }}
  labels:
    app: mixer
    istio: mixer
    release: {{ .Release.Name }}
spec:
  ports:
  - name: grpc-mixer
    port: 9091
  - name: grpc-mixer-mtls
    port: 15004
  - name: http-monitoring
    port: 15014
  - name: prometheus
    port: 42422
  selector:
    istio: mixer
    istio-mixer-type: telemetry
{{- if .Values.mixer.telemetry.sessionAffinityEnabled }}
  sessionAffinity: ClientIP
{{- end }}
---
`)

func chartsIstioTelemetryMixerTelemetryTemplatesServiceYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryMixerTelemetryTemplatesServiceYaml, nil
}

func chartsIstioTelemetryMixerTelemetryTemplatesServiceYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryMixerTelemetryTemplatesServiceYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/mixer-telemetry/templates/service.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryMixerTelemetryTemplatesServiceaccountYaml = []byte(`apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end }}
metadata:
  name: istio-mixer-service-account
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
---
`)

func chartsIstioTelemetryMixerTelemetryTemplatesServiceaccountYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryMixerTelemetryTemplatesServiceaccountYaml, nil
}

func chartsIstioTelemetryMixerTelemetryTemplatesServiceaccountYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryMixerTelemetryTemplatesServiceaccountYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/mixer-telemetry/templates/serviceaccount.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryMixerTelemetryTemplatesStackdriverYaml = []byte(`{{- if .Values.mixer.adapters.stackdriver.enabled }}
apiVersion: "config.istio.io/v1alpha2"
kind: handler
metadata:
  name: stackdriver
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledAdapter: stackdriver
  params:
    {{- if .Values.mixer.adapters.stackdriver.tracer.enabled }}
    trace:
      sampleProbability: {{ .Values.mixer.adapters.stackdriver.tracer.sampleProbability | default 1 }}
    {{- end }}
    pushInterval: 10s
    {{- if ne .Values.mixer.adapters.stackdriver.auth.serviceAccountPath "" }}
    serviceAccountPath: {{ .Values.mixer.adapters.stackdriver.auth.serviceAccountPath }}
    {{- end }}
    {{- if ne .Values.mixer.adapters.stackdriver.auth.apiKey "" }}
    apiKey: {{ .Values.mixer.adapters.stackdriver.auth.apiKey }}
    {{- end }}
    {{- if .Values.mixer.adapters.stackdriver.auth.appCredentials }}
    appCredentials: {{ .Values.mixer.adapters.stackdriver.auth.appCredentials }}
    {{- end }}
    {{- if .Values.mixer.adapters.stackdriver.metrics.enabled }}
    metricInfo:
      server-request-count.instance.{{ .Release.Namespace }}:
        # Due to a bug in gogoproto deserialization, Enums in maps must be
        # specified by their integer value, not variant name. See
        # https://github.com/googleapis/googleapis/blob/master/google/api/metric.proto
        # MetricKind and ValueType for the values to provide.
        kind: 3 # CUMULATIVE
        value: 2 # INT64
        metric_type: "istio.io/service/server/request_count"
      server-request-bytes.instance.{{ .Release.Namespace }}:
        kind: 3 # CUMULATIVE
        value: 5 # DISTRIBUTION
        buckets:
          exponentialBuckets:
            numFiniteBuckets: 20
            scale: 1
            growthFactor: 2
        metric_type: "istio.io/service/server/request_bytes"
      server-response-bytes.instance.{{ .Release.Namespace }}:
        kind: 3 # CUMULATIVE
        value: 5 # DISTRIBUTION
        buckets:
          exponentialBuckets:
            numFiniteBuckets: 20
            scale: 1
            growthFactor: 2
        metric_type: "istio.io/service/server/response_bytes"
      server-response-latencies.instance.{{ .Release.Namespace }}:
        kind: 3 # CUMULATIVE
        value: 5 # DISTRIBUTION
        buckets:
          exponentialBuckets:
            numFiniteBuckets: 20
            scale: 1
            growthFactor: 2
        metric_type: "istio.io/service/server/response_latencies"
      server-received-bytes-count.instance.{{ .Release.Namespace }}:
        kind: 3 # CUMULATIVE
        value: 2 # INT64
        metric_type: "istio.io/service/server/received_bytes_count"
      server-sent-bytes-count.instance.{{ .Release.Namespace }}:
        kind: 3 # CUMULATIVE
        value: 2 # INT64
        metric_type: "istio.io/service/server/sent_bytes_count"
      client-request-count.instance.{{ .Release.Namespace }}:
        kind: 3 # CUMULATIVE
        value: 2 # INT64
        metric_type: "istio.io/service/client/request_count"
      client-request-bytes.instance.{{ .Release.Namespace }}:
        kind: 3 # CUMULATIVE
        value: 5 # DISTRIBUTION
        buckets:
          exponentialBuckets:
            numFiniteBuckets: 20
            scale: 1
            growthFactor: 2
        metric_type: "istio.io/service/client/request_bytes"
      client-response-bytes.instance.{{ .Release.Namespace }}:
        kind: 3 # CUMULATIVE
        value: 5 # DISTRIBUTION
        buckets:
          exponentialBuckets:
            numFiniteBuckets: 20
            scale: 1
            growthFactor: 2
        metric_type: "istio.io/service/client/response_bytes"
      client-roundtrip-latencies.instance.{{ .Release.Namespace }}:
        kind: 3 # CUMULATIVE
        value: 5 # DISTRIBUTION
        buckets:
          exponentialBuckets:
            numFiniteBuckets: 20
            scale: 1
            growthFactor: 2
        metric_type: "istio.io/service/client/roundtrip_latencies"
      client-received-bytes-count.instance.{{ .Release.Namespace }}:
        kind: 3 # CUMULATIVE
        value: 2 # INT64
        metric_type: "istio.io/service/client/received_bytes_count"
      client-sent-bytes-count.instance.{{ .Release.Namespace }}:
        kind: 3 # CUMULATIVE
        value: 2 # INT64
        metric_type: "istio.io/service/client/sent_bytes_count"
    {{- end }}
    {{- if .Values.mixer.adapters.stackdriver.logging.enabled }}
    logInfo:
      server-accesslog-stackdriver.instance.{{ .Release.Namespace }}:
        labelNames:
        - mesh_uid
        - source_uid
        - source_ip
        - source_app
        - source_principal
        - source_name
        - source_workload
        - source_namespace
        - source_owner
        - destination_uid
        - destination_app
        - destination_ip
        - destination_service_host
        - destination_workload
        - destination_name
        - destination_namespace
        - destination_owner
        - destination_principal
        - api_name
        - api_version
        - api_claims
        - api_key
        - request_operation
        - protocol
        - method
        - url
        - response_code
        - response_size
        - request_size
        - request_id
        - latency
        - service_authentication_policy
        - user_agent
        - response_timestamp
        - received_bytes
        - sent_bytes
        - referer
      server-tcp-accesslog-stackdriver.instance.{{ .Release.Namespace }}:
        labelNames:
        - mesh_uid
        - connection_id
        - connection_event
        - source_uid
        - source_ip
        - source_app
        - source_principal
        - source_name
        - source_workload
        - source_namespace
        - source_owner
        - destination_uid
        - destination_app
        - destination_ip
        - destination_service_host
        - destination_workload
        - destination_name
        - destination_namespace
        - destination_owner
        - destination_principal
        - protocol
        - connction_duration
        - service_authentication_policy
        - received_bytes
        - sent_bytes
        - total_received_bytes
        - total_sent_bytes
      {{- end }}
---
{{- if .Values.mixer.adapters.stackdriver.metrics.enabled }}
#################################################
############## Metric Config ####################
#################################################
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: stackdriver-server
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  match: (context.protocol == "http" || context.protocol == "grpc") && (context.reporter.kind | "inbound" == "inbound")
  actions:
  - handler: stackdriver
    instances:
    - server-request-count
    - server-request-bytes
    - server-response-bytes
    - server-response-latencies
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: stackdriver-client
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  match: (context.protocol == "http" || context.protocol == "grpc") && (context.reporter.kind | "inbound" == "outbound")
  actions:
  - handler: stackdriver
    instances:
    - client-request-count
    - client-request-bytes
    - client-response-bytes
    - client-roundtrip-latencies
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: stackdriver-tcp-server
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  match: context.protocol == "tcp" && (context.reporter.kind | "inbound" == "inbound")
  actions:
  - handler: stackdriver
    instances:
    - server-received-bytes-count
    - server-sent-bytes-count
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: stackdriver-tcp-client
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  match: context.protocol == "tcp" && (context.reporter.kind | "inbound" == "outbound")
  actions:
  - handler: stackdriver
    instances:
    - client-received-bytes-count
    - client-sent-bytes-count
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: server-request-count
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: "1"
    dimensions:
      mesh_uid: '"{{ .Values.global.meshID }}"'
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      destination_port: destination.port | 0
      request_operation: conditional((context.protocol | "unknown") == "grpc", request.path | "unknown", request.method | "unknown")
      request_protocol: context.protocol | "unknown"
      api_version: api.version | "unknown"
      api_name: api.service | "unknown"
      response_code: response.code | 0
      service_authentication_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      source_workload_namespace: source.workload.namespace | "unknown"
      source_workload_name: source.workload.name | "unknown"
      source_owner: source.owner | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_workload_name: destination.workload.name | "unknown"
      destination_owner: destination.owner | "unknown"
      destination_principal: destination.principal | "unknown"
      source_principal: source.principal | "unknown"
    monitoredResourceType: '"k8s_container"'
    monitoredResourceDimensions:
      project_id: '""'
      cluster_name: '""'
      namespace_name: destination.workload.namespace | "unknown"
      location: '""'
      container_name: conditional((destination.name | "unknown").startsWith("istio-telemetry") || (destination.name | "unknown").startsWith("istio-policy"), "mixer", destination.container.name | "unknown")
      pod_name: destination.name | "unknown"
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: client-request-count
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: "1"
    dimensions:
      mesh_uid: '"{{ .Values.global.meshID }}"'
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      destination_port: destination.port | 0
      request_operation: conditional((context.protocol | "unknown") == "grpc", request.path | "unknown", request.method | "unknown")
      request_protocol: context.protocol | "unknown"
      api_version: api.version | "unknown"
      api_name: api.service | "unknown"
      response_code: response.code | 0
      service_authentication_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      source_workload_namespace: source.workload.namespace | "unknown"
      source_workload_name: source.workload.name | "unknown"
      source_owner: source.owner | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_workload_name: destination.workload.name | "unknown"
      destination_owner: destination.owner | "unknown"
      destination_principal: destination.principal | "unknown"
      source_principal: source.principal | "unknown"
    monitoredResourceType: '"k8s_pod"'
    monitoredResourceDimensions:
      project_id: '""'
      cluster_name: '""'
      namespace_name: source.workload.namespace | "unknown"
      location: '""'
      pod_name: source.name | "unknown"
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: server-request-bytes
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: request.total_size
    dimensions:
      mesh_uid: '"{{ .Values.global.meshID }}"'
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      destination_port: destination.port | 0
      request_operation: conditional((context.protocol | "unknown") == "grpc", request.path | "unknown", request.method | "unknown")
      request_protocol: context.protocol | "unknown"
      api_version: api.version | "unknown"
      api_name: api.service | "unknown"
      response_code: response.code | 0
      service_authentication_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      source_workload_namespace: source.workload.namespace | "unknown"
      source_workload_name: source.workload.name | "unknown"
      source_owner: source.owner | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_workload_name: destination.workload.name | "unknown"
      destination_owner: destination.owner | "unknown"
      destination_principal: destination.principal | "unknown"
      source_principal: source.principal | "unknown"
    monitoredResourceType: '"k8s_container"'
    monitoredResourceDimensions:
      project_id: '""'
      cluster_name: '""'
      namespace_name: destination.workload.namespace | "unknown"
      location: '""'
      container_name: conditional((destination.name | "unknown").startsWith("istio-telemetry") || (destination.name | "unknown").startsWith("istio-policy"), "mixer", destination.container.name | "unknown")
      pod_name: destination.name | "unknown"
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: client-request-bytes
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: request.total_size
    dimensions:
      mesh_uid: '"{{ .Values.global.meshID }}"'
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      destination_port: destination.port | 0
      request_operation: conditional((context.protocol | "unknown") == "grpc", request.path | "unknown", request.method | "unknown")
      request_protocol: context.protocol | "unknown"
      api_version: api.version | "unknown"
      api_name: api.service | "unknown"
      response_code: response.code | 0
      service_authentication_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      source_workload_namespace: source.workload.namespace | "unknown"
      source_workload_name: source.workload.name | "unknown"
      source_owner: source.owner | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_workload_name: destination.workload.name | "unknown"
      destination_owner: destination.owner | "unknown"
      destination_principal: destination.principal | "unknown"
      source_principal: source.principal | "unknown"
    monitoredResourceType: '"k8s_pod"'
    monitoredResourceDimensions:
      project_id: '""'
      cluster_name: '""'
      namespace_name: source.workload.namespace | "unknown"
      location: '""'
      pod_name: source.name | "unknown"
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: server-response-bytes
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: response.total_size
    dimensions:
      mesh_uid: '"{{ .Values.global.meshID }}"'
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      destination_port: destination.port | 0
      request_operation: conditional((context.protocol | "unknown") == "grpc", request.path | "unknown", request.method | "unknown")
      request_protocol: context.protocol | "unknown"
      api_version: api.version | "unknown"
      api_name: api.service | "unknown"
      response_code: response.code | 0
      service_authentication_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      source_workload_namespace: source.workload.namespace | "unknown"
      source_workload_name: source.workload.name | "unknown"
      source_owner: source.owner | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_workload_name: destination.workload.name | "unknown"
      destination_owner: destination.owner | "unknown"
      destination_principal: destination.principal | "unknown"
      source_principal: source.principal | "unknown"
    monitoredResourceType: '"k8s_container"'
    monitoredResourceDimensions:
      project_id: '""'
      cluster_name: '""'
      namespace_name: destination.workload.namespace | "unknown"
      location: '""'
      container_name: conditional((destination.name | "unknown").startsWith("istio-telemetry") || (destination.name | "unknown").startsWith("istio-policy"), "mixer", destination.container.name | "unknown")
      pod_name: destination.name | "unknown"
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: client-response-bytes
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: response.total_size
    dimensions:
      mesh_uid: '"{{ .Values.global.meshID }}"'
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      destination_port: destination.port | 0
      request_operation: conditional((context.protocol | "unknown") == "grpc", request.path | "unknown", request.method | "unknown")
      request_protocol: context.protocol | "unknown"
      api_version: api.version | "unknown"
      api_name: api.service | "unknown"
      response_code: response.code | 0
      service_authentication_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      source_workload_namespace: source.workload.namespace | "unknown"
      source_workload_name: source.workload.name | "unknown"
      source_owner: source.owner | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_workload_name: destination.workload.name | "unknown"
      destination_owner: destination.owner | "unknown"
      destination_principal: destination.principal | "unknown"
      source_principal: source.principal | "unknown"
    monitoredResourceType: '"k8s_pod"'
    monitoredResourceDimensions:
      project_id: '""'
      cluster_name: '""'
      namespace_name: source.workload.namespace | "unknown"
      location: '""'
      pod_name: source.name | "unknown"
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: server-response-latencies
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: response.duration
    dimensions:
      mesh_uid: '"{{ .Values.global.meshID }}"'
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      destination_port: destination.port | 0
      request_operation: conditional((context.protocol | "unknown") == "grpc", request.path | "unknown", request.method | "unknown")
      request_protocol: context.protocol | "unknown"
      api_version: api.version | "unknown"
      api_name: api.service | "unknown"
      response_code: response.code | 0
      service_authentication_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      source_workload_namespace: source.workload.namespace | "unknown"
      source_workload_name: source.workload.name | "unknown"
      source_owner: source.owner | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_workload_name: destination.workload.name | "unknown"
      destination_owner: destination.owner | "unknown"
      destination_principal: destination.principal | "unknown"
      source_principal: source.principal | "unknown"
    monitoredResourceType: '"k8s_container"'
    monitoredResourceDimensions:
      project_id: '""'
      cluster_name: '""'
      namespace_name: destination.workload.namespace | "unknown"
      location: '""'
      container_name: conditional((destination.name | "unknown").startsWith("istio-telemetry") || (destination.name | "unknown").startsWith("istio-policy"), "mixer", destination.container.name | "unknown")
      pod_name: destination.name | "unknown"
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: client-roundtrip-latencies
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: response.duration
    dimensions:
      mesh_uid: '"{{ .Values.global.meshID }}"'
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      destination_port: destination.port | 0
      request_operation: conditional((context.protocol | "unknown") == "grpc", request.path | "unknown", request.method | "unknown")
      request_protocol: context.protocol | "unknown"
      api_version: api.version | "unknown"
      api_name: api.service | "unknown"
      response_code: response.code | 0
      service_authentication_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      source_workload_namespace: source.workload.namespace | "unknown"
      source_workload_name: source.workload.name | "unknown"
      source_owner: source.owner | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_workload_name: destination.workload.name | "unknown"
      destination_owner: destination.owner | "unknown"
      destination_principal: destination.principal | "unknown"
      source_principal: source.principal | "unknown"
    monitoredResourceType: '"k8s_pod"'
    monitoredResourceDimensions:
      project_id: '""'
      cluster_name: '""'
      namespace_name: source.workload.namespace | "unknown"
      location: '""'
      pod_name: source.name | "unknown"
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: server-received-bytes-count
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: connection.received.bytes | 0
    dimensions:
      mesh_uid: '"{{ .Values.global.meshID }}"'
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      destination_port: destination.port | 0
      request_protocol: context.protocol | "unknown"
      service_authentication_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      source_workload_namespace: source.workload.namespace | "unknown"
      source_workload_name: source.workload.name | "unknown"
      source_owner: source.owner | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_workload_name: destination.workload.name | "unknown"
      destination_owner: destination.owner | "unknown"
      destination_principal: destination.principal | "unknown"
      source_principal: source.principal | "unknown"
    monitoredResourceType: '"k8s_container"'
    monitoredResourceDimensions:
      project_id: '""'
      cluster_name: '""'
      namespace_name: destination.workload.namespace | "unknown"
      location: '""'
      container_name: conditional((destination.name | "unknown").startsWith("istio-telemetry") || (destination.name | "unknown").startsWith("istio-policy"), "mixer", destination.container.name | "unknown")
      pod_name: destination.name | "unknown"
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: client-received-bytes-count
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: connection.received.bytes | 0
    dimensions:
      mesh_uid: '"{{ .Values.global.meshID }}"'
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      destination_port: destination.port | 0
      request_protocol: context.protocol | "unknown"
      service_authentication_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      source_workload_namespace: source.workload.namespace | "unknown"
      source_workload_name: source.workload.name | "unknown"
      source_owner: source.owner | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_workload_name: destination.workload.name | "unknown"
      destination_owner: destination.owner | "unknown"
      destination_principal: destination.principal | "unknown"
      source_principal: source.principal | "unknown"
    monitoredResourceType: '"k8s_pod"'
    monitoredResourceDimensions:
      project_id: '""'
      cluster_name: '""'
      namespace_name: source.workload.namespace | "unknown"
      location: '""'
      pod_name: source.name | "unknown"
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: server-sent-bytes-count
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: connection.sent.bytes | 0
    dimensions:
      mesh_uid: '"{{ .Values.global.meshID }}"'
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      destination_port: destination.port | 0
      request_protocol: context.protocol | "unknown"
      service_authentication_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      source_workload_namespace: source.workload.namespace | "unknown"
      source_workload_name: source.workload.name | "unknown"
      source_owner: source.owner | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_workload_name: destination.workload.name | "unknown"
      destination_owner: destination.owner | "unknown"
      destination_principal: destination.principal | "unknown"
      source_principal: source.principal | "unknown"
    monitoredResourceType: '"k8s_container"'
    monitoredResourceDimensions:
      project_id: '""'
      cluster_name: '""'
      namespace_name: destination.workload.namespace | "unknown"
      location: '""'
      container_name: conditional((destination.name | "unknown").startsWith("istio-telemetry") || (destination.name | "unknown").startsWith("istio-policy"), "mixer", destination.container.name | "unknown")
      pod_name: destination.name | "unknown"
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: client-sent-bytes-count
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: metric
  params:
    value: connection.sent.bytes | 0
    dimensions:
      mesh_uid: '"{{ .Values.global.meshID }}"'
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      destination_port: destination.port | 0
      request_protocol: context.protocol | "unknown"
      service_authentication_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      source_workload_namespace: source.workload.namespace | "unknown"
      source_workload_name: source.workload.name | "unknown"
      source_owner: source.owner | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_workload_name: destination.workload.name | "unknown"
      destination_owner: destination.owner | "unknown"
      destination_principal: destination.principal | "unknown"
      source_principal: source.principal | "unknown"
    monitoredResourceType: '"k8s_pod"'
    monitoredResourceDimensions:
      project_id: '""'
      cluster_name: '""'
      namespace_name: source.workload.namespace | "unknown"
      location: '""'
      pod_name: source.name | "unknown"
{{- end }}
---
{{- if .Values.mixer.adapters.stackdriver.logging.enabled }}
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: server-accesslog-stackdriver
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: logentry
  params:
    severity: '"Info"'
    timestamp: request.time
    variables:
      mesh_uid: '"{{ .Values.global.meshID }}"'
      source_uid: source.uid | ""
      source_ip: source.ip | ip("0.0.0.0")
      source_app: source.labels["app"] | ""
      source_principal: source.principal | ""
      source_name: source.name | ""
      source_workload: source.workload.name | ""
      source_namespace: source.namespace | ""
      source_owner: source.owner | ""
      destination_uid: destination.uid | ""
      destination_app: destination.labels["app"] | ""
      destination_ip: destination.ip | ip("0.0.0.0")
      destination_service_host: destination.service.host | ""
      destination_workload: destination.workload.name | ""
      destination_name: destination.name | ""
      destination_namespace: destination.namespace | ""
      destination_owner: destination.owner | ""
      destination_principal: destination.principal | ""
      api_name: api.service | ""
      api_version: api.version | ""
      api_claims: request.auth.raw_claims | ""
      api_key: request.api_key | request.headers["x-api-key"] | ""
      request_operation: conditional((context.protocol | "unknown") == "grpc", request.path | "unknown", request.method | "unknown")
      protocol: request.scheme | context.protocol | "http"
      method: request.method | ""
      url: request.path | ""
      response_code: response.code | 0
      response_size: response.size | 0
      request_size: request.size | 0
      request_id: request.headers["x-request-id"] | ""
      latency: response.duration | "0ms"
      service_authentication_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      user_agent: request.useragent | ""
      response_timestamp: response.time
      received_bytes: request.total_size | 0
      sent_bytes: response.total_size | 0
      referer: request.referer | ""
    monitored_resource_type: '"k8s_container"'
    monitoredResourceDimensions:
      project_id: '""'
      cluster_name: '""'
      namespace_name: destination.namespace | "unknown"
      location: '""'
      container_name: conditional((destination.name | "unknown").startsWith("istio-telemetry") || (destination.name | "unknown").startsWith("istio-policy"), "mixer", destination.container.name | "unknown")
      pod_name: destination.name | "unknown"
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: server-tcp-accesslog-stackdriver
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: logentry
  params:
    severity: '"Info"'
    timestamp: context.time | timestamp("2017-01-01T00:00:00Z")
    variables:
      mesh_uid: '"{{ .Values.global.meshID }}"'
      source_uid: source.uid | ""
      connection_id: connection.id | ""
      connection_event: connection.event | ""
      source_ip: source.ip | ip("0.0.0.0")
      source_app: source.labels["app"] | ""
      source_principal: source.principal | ""
      source_name: source.name | ""
      source_workload: source.workload.name | ""
      source_namespace: source.namespace | ""
      source_owner: source.owner | ""
      destination_uid: destination.uid | ""
      destination_app: destination.labels["app"] | ""
      destination_ip: destination.ip | ip("0.0.0.0")
      destination_service_host: destination.service.host | ""
      destination_workload: destination.workload.name | ""
      destination_name: destination.name | ""
      destination_namespace: destination.namespace | ""
      destination_owner: destination.owner | ""
      destination_principal: destination.principal | ""
      protocol: context.protocol | "tcp"
      connction_duration: connection.duration | "0ms"
      service_authentication_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      received_bytes: connection.received.bytes | 0
      sent_bytes: connection.sent.bytes | 0
      total_received_bytes: connection.received.bytes_total | 0
      total_sent_bytes: connection.sent.bytes_total | 0
    monitored_resource_type: '"k8s_container"'
    monitoredResourceDimensions:
      project_id: '""'
      cluster_name: '""'
      namespace_name: destination.namespace | "unknown"
      location: '""'
      container_name: conditional((destination.name | "unknown").startsWith("istio-telemetry") || (destination.name | "unknown").startsWith("istio-policy"), "mixer", destination.container.name | "unknown")
      pod_name: destination.name | "unknown"
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: stackdriver-log
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  match: (context.protocol == "http" || context.protocol == "grpc") && (context.reporter.kind | "inbound" == "inbound")
  actions:
  - handler: stackdriver
    instances:
    - server-accesslog-stackdriver
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: stackdriver-log-tcp
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  match: (context.protocol == "tcp") && (context.reporter.kind | "inbound" == "inbound")
  actions:
  - handler: stackdriver
    instances:
    - server-tcp-accesslog-stackdriver
{{- end }}
---
{{- if .Values.mixer.adapters.stackdriver.tracer.enabled }}
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: stackdriver-span
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: tracespan
  params:
    traceId: request.headers["x-b3-traceid"]
    spanId: request.headers["x-b3-spanid"] | ""
    parentSpanId: request.headers["x-b3-parentspanid"] | ""
    spanName: destination.service.host | destination.service.name | destination.workload.name | "unknown"
    startTime: request.time
    endTime: response.time
    clientSpan: (context.reporter.kind | "inbound") == "outbound"
    rewriteClientSpanId: "true"
    spanTags:
      destination_service_name: destination.service.name | "unknown"
      destination_service_namespace: destination.service.namespace | "unknown"
      destination_port: destination.port | 0
      request_operation: conditional((context.protocol | "unknown") == "grpc", request.path | "unknown", request.method | "unknown")
      request_protocol: context.protocol | "unknown"
      api_version: api.version | "unknown"
      api_name: api.service | "unknown"
      response_code: response.code | 0
      service_authentication_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
      source_workload_namespace: source.workload.namespace | "unknown"
      source_workload_name: source.workload.name | "unknown"
      source_owner: source.owner | "unknown"
      destination_workload_namespace: destination.workload.namespace | "unknown"
      destination_workload_name: destination.workload.name | "unknown"
      destination_owner: destination.owner | "unknown"
      http_url: request.path | ""
      request_size: request.size | 0
      response_size: response.size | 0
      source_ip: source.ip | ip("0.0.0.0")
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: stackdriver-tracing-rule
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  match: (context.protocol == "http" || context.protocol == "grpc") && request.headers["x-b3-sampled"] == "1" && destination.workload.name != "istio-telemetry" && destination.workload.name != "istio-pilot"
  actions:
  - handler: stackdriver
    instances:
    - stackdriver-span
{{- end }}
---
{{- if .Values.mixer.adapters.stackdriver.contextGraph.enabled }}
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: stackdriver-edge
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  compiledTemplate: edge
  params:
    timestamp: request.time | context.time | timestamp("2017-01-01T00:00:00Z")
    sourceUid: source.uid | "Unknown"
    sourceOwner: source.owner | "Unknown"
    sourceWorkloadName: source.workload.name | "Unknown"
    sourceWorkloadNamespace: source.workload.namespace | "Unknown"
    destinationUid: destination.uid | "Unknown"
    destinationOwner: destination.owner | "Unknown"
    destinationWorkloadName: destination.workload.name | "Unknown"
    destinationWorkloadNamespace: destination.workload.namespace | "Unknown"
    contextProtocol: context.protocol | "Unknown"
    apiProtocol: api.protocol | "Unknown"
    destinationServiceName: destination.service.name | "Unknown"
    destinationServiceNamespace: destination.service.namespace | "Unknown"
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: stackdriver-edge
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-telemetry
    release: {{ .Release.Name }}
spec:
  match: (context.reporter.kind | "inbound" == "inbound") && (context.protocol | "unknown" != "unknown")
  actions:
   - handler: stackdriver
     instances:
     - stackdriver-edge
{{- end }}
{{- end }}
`)

func chartsIstioTelemetryMixerTelemetryTemplatesStackdriverYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryMixerTelemetryTemplatesStackdriverYaml, nil
}

func chartsIstioTelemetryMixerTelemetryTemplatesStackdriverYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryMixerTelemetryTemplatesStackdriverYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/mixer-telemetry/templates/stackdriver.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryMixerTelemetryValuesYaml = []byte(`mixer:

  adapters:
    # stdio is a debug adapter in istio-telemetry, it is not recommended for production use.
    stdio:
      # If set to true, will add 'rule' and 'stdio' handler for access logs.
      # If false, user will need to configure their own rules outside of installer.
      enabled: false
      outputAsJson: false

    prometheus:
      enabled: true
      metricsExpiryDuration: 10m

    kubernetesenv:
      enabled: true

    stackdriver:
      enabled: false

      auth:
        appCredentials: false
        apiKey: ""
        serviceAccountPath: ""

      tracer:
        enabled: false
        sampleProbability: 1

      contextGraph:
        enabled: false

      logging:
        enabled: true

      metrics:
        enabled: true

    # Setting this to false sets the useAdapterCRDs mixer startup argument to false
    useAdapterCRDs: false

  telemetry:
    hub: ""
    tag: ""
    image: mixer
    enabled: true
    replicaCount: 1
    rollingMaxSurge: 100%
    rollingMaxUnavailable: 25%
    autoscaleEnabled: true
    autoscaleMin: 1
    autoscaleMax: 5
    cpu:
      targetAverageUtilization: 80
    sessionAffinityEnabled: false

    env:
      # max procs should be ceil(cpu limit + 1)
      GOMAXPROCS: "6"

    # mixer load shedding configuration.
    # When mixer detects that it is overloaded, it starts rejecting grpc requests.
    loadshedding:
      # disabled, logonly or enforce
      mode: enforce
      # based on measurements 100ms p50 translates to p99 of under 1s. This is ok for telemetry which is inherently async.
      latencyThreshold: 100ms
    resources:
      requests:
        cpu: 1000m
        memory: 1G
      limits:
        # It is best to do horizontal scaling of mixer using moderate cpu allocation.
        # We have experimentally found that these values work well.
        cpu: 4800m
        memory: 4G

    # Set reportBatchMaxEntries to 0 to use the default batching behavior (i.e., every 100 requests).
    # A positive value indicates the number of requests that are batched before telemetry data
    # is sent to the mixer server
    reportBatchMaxEntries: 100

    # Set reportBatchMaxTime to 0 to use the default batching behavior (i.e., every 1 second).
    # A positive time value indicates the maximum wait time since the last request will telemetry data
    # be batched before being sent to the mixer server
    reportBatchMaxTime: 1s

    nodeSelector: {}
    tolerations: []
    podAnnotations: {}

    # Specify the pod anti-affinity that allows you to constrain which nodes
    # your pod is eligible to be scheduled based on labels on pods that are
    # already running on the node rather than based on labels on nodes.
    # There are currently two types of anti-affinity:
    #    "requiredDuringSchedulingIgnoredDuringExecution"
    #    "preferredDuringSchedulingIgnoredDuringExecution"
    # which denote "hard" vs. "soft" requirements, you can define your values
    # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
    # correspondingly.
    # For example:
    # podAntiAffinityLabelSelector:
    # - key: security
    #   operator: In
    #   values: S1,S2
    #   topologyKey: "kubernetes.io/hostname"
    # This pod anti-affinity rule says that the pod requires not to be scheduled
    # onto a node if that node is already running a pod with label having key
    # "security" and value "S1".
    podAntiAffinityLabelSelector: []
    podAntiAffinityTermLabelSelector: []
`)

func chartsIstioTelemetryMixerTelemetryValuesYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryMixerTelemetryValuesYaml, nil
}

func chartsIstioTelemetryMixerTelemetryValuesYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryMixerTelemetryValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/mixer-telemetry/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryPrometheusChartYaml = []byte(`apiVersion: v1
description: A Helm chart for Kubernetes
name: prometheus
version: 1.1.0
appVersion: 2.8.0
tillerVersion: ">=2.7.2"
`)

func chartsIstioTelemetryPrometheusChartYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryPrometheusChartYaml, nil
}

func chartsIstioTelemetryPrometheusChartYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryPrometheusChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/prometheus/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryPrometheusTemplates_affinityTpl = []byte(`{{/* affinity - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ */}}

{{- define "nodeaffinity" }}
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityRequiredDuringScheduling" . }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityPreferredDuringScheduling" . }}
{{- end }}

{{- define "nodeAffinityRequiredDuringScheduling" }}
      nodeSelectorTerms:
      - matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
        {{- range $key, $val := .Values.global.arch }}
          {{- if gt ($val | int) 0 }}
          - {{ $key | quote }}
          {{- end }}
        {{- end }}
        {{- $nodeSelector := default .Values.global.defaultNodeSelector .Values.prometheus.nodeSelector -}}
        {{- range $key, $val := $nodeSelector }}
        - key: {{ $key }}
          operator: In
          values:
          - {{ $val | quote }}
        {{- end }}
{{- end }}

{{- define "nodeAffinityPreferredDuringScheduling" }}
  {{- range $key, $val := .Values.global.arch }}
    {{- if gt ($val | int) 0 }}
    - weight: {{ $val | int }}
      preference:
        matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
          - {{ $key | quote }}
    {{- end }}
  {{- end }}
{{- end }}

{{- define "podAntiAffinity" }}
{{- if or .Values.prometheus.podAntiAffinityLabelSelector .Values.prometheus.podAntiAffinityTermLabelSelector}}
  podAntiAffinity:
    {{- if .Values.prometheus.podAntiAffinityLabelSelector }}
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityRequiredDuringScheduling" . }}
    {{- end }}
    {{- if .Values.prometheus.podAntiAffinityTermLabelSelector }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityPreferredDuringScheduling" . }}
    {{- end }}
{{- end }}
{{- end }}

{{- define "podAntiAffinityRequiredDuringScheduling" }}
    {{- range $index, $item := .Values.prometheus.podAntiAffinityLabelSelector }}
    - labelSelector:
        matchExpressions:
        - key: {{ $item.key }}
          operator: {{ $item.operator }}
          {{- if $item.values }}
          values:
          {{- $vals := split "," $item.values }}
          {{- range $i, $v := $vals }}
          - {{ $v | quote }}
          {{- end }}
          {{- end }}
      topologyKey: {{ $item.topologyKey }}
    {{- end }}
{{- end }}

{{- define "podAntiAffinityPreferredDuringScheduling" }}
    {{- range $index, $item := .Values.prometheus.podAntiAffinityTermLabelSelector }}
    - podAffinityTerm:
        labelSelector:
          matchExpressions:
          - key: {{ $item.key }}
            operator: {{ $item.operator }}
            {{- if $item.values }}
            values:
            {{- $vals := split "," $item.values }}
            {{- range $i, $v := $vals }}
            - {{ $v | quote }}
            {{- end }}
            {{- end }}
        topologyKey: {{ $item.topologyKey }}
      weight: 100
    {{- end }}
{{- end }}
`)

func chartsIstioTelemetryPrometheusTemplates_affinityTplBytes() ([]byte, error) {
	return _chartsIstioTelemetryPrometheusTemplates_affinityTpl, nil
}

func chartsIstioTelemetryPrometheusTemplates_affinityTpl() (*asset, error) {
	bytes, err := chartsIstioTelemetryPrometheusTemplates_affinityTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/prometheus/templates/_affinity.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryPrometheusTemplatesClusterroleYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: prometheus-{{ .Release.Namespace }}
  labels:
    app: prometheus
    release: {{ .Release.Name }}
rules:
- apiGroups: [""]
  resources:
  - nodes
  - services
  - endpoints
  - pods
  - nodes/proxy
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources:
  - configmaps
  verbs: ["get"]
- nonResourceURLs: ["/metrics"]
  verbs: ["get"]
`)

func chartsIstioTelemetryPrometheusTemplatesClusterroleYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryPrometheusTemplatesClusterroleYaml, nil
}

func chartsIstioTelemetryPrometheusTemplatesClusterroleYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryPrometheusTemplatesClusterroleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/prometheus/templates/clusterrole.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryPrometheusTemplatesClusterrolebindingsYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: prometheus-{{ .Release.Namespace }}
  labels:
    app: prometheus
    release: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: prometheus-{{ .Release.Namespace }}
subjects:
- kind: ServiceAccount
  name: prometheus
  namespace: {{ .Release.Namespace }}
`)

func chartsIstioTelemetryPrometheusTemplatesClusterrolebindingsYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryPrometheusTemplatesClusterrolebindingsYaml, nil
}

func chartsIstioTelemetryPrometheusTemplatesClusterrolebindingsYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryPrometheusTemplatesClusterrolebindingsYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/prometheus/templates/clusterrolebindings.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryPrometheusTemplatesConfigmapYaml = []byte(`apiVersion: v1
kind: ConfigMap
metadata:
  name: prometheus
  namespace: {{ .Release.Namespace }}
  labels:
    app: prometheus
    release: {{ .Release.Name }}
data:
  prometheus.yml: |-
    global:
      scrape_interval: {{ .Values.prometheus.scrapeInterval }}
    scrape_configs:

    # Mixer scrapping. Defaults to Prometheus and mixer on same namespace.
    #
    - job_name: 'istio-mesh'
      kubernetes_sd_configs:
      - role: endpoints
        namespaces:
          names:
          - {{ .Release.Namespace }}
      relabel_configs:
      - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
        action: keep
        regex: istio-telemetry;prometheus

    # Scrape config for envoy stats
    - job_name: 'envoy-stats'
      metrics_path: /stats/prometheus
      kubernetes_sd_configs:
      - role: pod

      relabel_configs:
      - source_labels: [__meta_kubernetes_pod_container_port_name]
        action: keep
        regex: '.*-envoy-prom'
      - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
        action: replace
        regex: ([^:]+)(?::\d+)?;(\d+)
        replacement: $1:15090
        target_label: __address__
      - action: labeldrop
        regex: __meta_kubernetes_pod_label_(.+)
      - source_labels: [__meta_kubernetes_namespace]
        action: replace
        target_label: namespace
      - source_labels: [__meta_kubernetes_pod_name]
        action: replace
        target_label: pod_name

    - job_name: 'istio-policy'
      kubernetes_sd_configs:
      - role: endpoints
        namespaces:
          names:
          - {{ .Values.global.policyNamespace }}


      relabel_configs:
      - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
        action: keep
        regex: istio-policy;http-policy-monitoring

    - job_name: 'istio-telemetry'
      kubernetes_sd_configs:
      - role: endpoints
        namespaces:
          names:
          - {{ .Values.global.telemetryNamespace }}

      relabel_configs:
      - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
        action: keep
        regex: istio-telemetry;http-monitoring

    - job_name: 'pilot'
      kubernetes_sd_configs:
      - role: endpoints
        namespaces:
          names:
          - {{ .Values.global.configNamespace }}

      relabel_configs:
      - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
        action: keep
        regex: istio-pilot;http-monitoring

    - job_name: 'galley'
      kubernetes_sd_configs:
      - role: endpoints
        namespaces:
          names:
          - {{ .Values.global.configNamespace }}

      relabel_configs:
      - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
        action: keep
        regex: istio-galley;http-monitoring

    - job_name: 'citadel'
      kubernetes_sd_configs:
      - role: endpoints
        namespaces:
          names:
          - {{ .Values.global.istioNamespace }}

      relabel_configs:
      - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
        action: keep
        regex: istio-citadel;http-monitoring

    - job_name: 'sidecar-injector'

      kubernetes_sd_configs:
      - role: endpoints
        namespaces:
          names:
          - {{ .Release.Namespace }}

      relabel_configs:
      - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
        action: keep
        regex: istio-sidecar-injector;http-monitoring

    # scrape config for API servers
    - job_name: 'kubernetes-apiservers'
      kubernetes_sd_configs:
      - role: endpoints
        namespaces:
          names:
          - default
      scheme: https
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      relabel_configs:
      - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
        action: keep
        regex: kubernetes;https

    # scrape config for nodes (kubelet)
    - job_name: 'kubernetes-nodes'
      scheme: https
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      kubernetes_sd_configs:
      - role: node
      relabel_configs:
      - action: labelmap
        regex: __meta_kubernetes_node_label_(.+)
      - target_label: __address__
        replacement: kubernetes.default.svc:443
      - source_labels: [__meta_kubernetes_node_name]
        regex: (.+)
        target_label: __metrics_path__
        replacement: /api/v1/nodes/${1}/proxy/metrics

    # Scrape config for Kubelet cAdvisor.
    #
    # This is required for Kubernetes 1.7.3 and later, where cAdvisor metrics
    # (those whose names begin with 'container_') have been removed from the
    # Kubelet metrics endpoint.  This job scrapes the cAdvisor endpoint to
    # retrieve those metrics.
    #
    # In Kubernetes 1.7.0-1.7.2, these metrics are only exposed on the cAdvisor
    # HTTP endpoint; use "replacement: /api/v1/nodes/${1}:4194/proxy/metrics"
    # in that case (and ensure cAdvisor's HTTP server hasn't been disabled with
    # the --cadvisor-port=0 Kubelet flag).
    #
    # This job is not necessary and should be removed in Kubernetes 1.6 and
    # earlier versions, or it will cause the metrics to be scraped twice.
    - job_name: 'kubernetes-cadvisor'
      scheme: https
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      kubernetes_sd_configs:
      - role: node
      relabel_configs:
      - action: labelmap
        regex: __meta_kubernetes_node_label_(.+)
      - target_label: __address__
        replacement: kubernetes.default.svc:443
      - source_labels: [__meta_kubernetes_node_name]
        regex: (.+)
        target_label: __metrics_path__
        replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor

    # scrape config for service endpoints.
    - job_name: 'kubernetes-service-endpoints'
      kubernetes_sd_configs:
      - role: endpoints
      relabel_configs:
      - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scrape]
        action: keep
        regex: true
      - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scheme]
        action: replace
        target_label: __scheme__
        regex: (https?)
      - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_path]
        action: replace
        target_label: __metrics_path__
        regex: (.+)
      - source_labels: [__address__, __meta_kubernetes_service_annotation_prometheus_io_port]
        action: replace
        target_label: __address__
        regex: ([^:]+)(?::\d+)?;(\d+)
        replacement: $1:$2
      - action: labelmap
        regex: __meta_kubernetes_service_label_(.+)
      - source_labels: [__meta_kubernetes_namespace]
        action: replace
        target_label: kubernetes_namespace
      - source_labels: [__meta_kubernetes_service_name]
        action: replace
        target_label: kubernetes_name

    - job_name: 'kubernetes-pods'
      kubernetes_sd_configs:
      - role: pod
      relabel_configs:  # If first two labels are present, pod should be scraped  by the istio-secure job.
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
        action: keep
        regex: true
      - source_labels: [__meta_kubernetes_pod_annotation_sidecar_istio_io_status]
        action: drop
        regex: (.+)
      - source_labels: [__meta_kubernetes_pod_annotation_istio_mtls]
        action: drop
        regex: (true)
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
        action: replace
        target_label: __metrics_path__
        regex: (.+)
      - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
        action: replace
        regex: ([^:]+)(?::\d+)?;(\d+)
        replacement: $1:$2
        target_label: __address__
      - action: labelmap
        regex: __meta_kubernetes_pod_label_(.+)
      - source_labels: [__meta_kubernetes_namespace]
        action: replace
        target_label: namespace
      - source_labels: [__meta_kubernetes_pod_name]
        action: replace
        target_label: pod_name

{{- if .Values.prometheus.provisionPrometheusCert }}
    - job_name: 'kubernetes-pods-istio-secure'
      scheme: https
      tls_config:
        ca_file: /etc/istio-certs/root-cert.pem
        cert_file: /etc/istio-certs/cert-chain.pem
        key_file: /etc/istio-certs/key.pem
        insecure_skip_verify: true  # prometheus does not support secure naming.
      kubernetes_sd_configs:
      - role: pod
      relabel_configs:
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
        action: keep
        regex: true
      # sidecar status annotation is added by sidecar injector and
      # istio_workload_mtls_ability can be specifically placed on a pod to indicate its ability to receive mtls traffic.
      - source_labels: [__meta_kubernetes_pod_annotation_sidecar_istio_io_status, __meta_kubernetes_pod_annotation_istio_mtls]
        action: keep
        regex: (([^;]+);([^;]*))|(([^;]*);(true))
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
        action: replace
        target_label: __metrics_path__
        regex: (.+)
      - source_labels: [__address__]  # Only keep address that is host:port
        action: keep    # otherwise an extra target with ':443' is added for https scheme
        regex: ([^:]+):(\d+)
      - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
        action: replace
        regex: ([^:]+)(?::\d+)?;(\d+)
        replacement: $1:$2
        target_label: __address__
      - action: labelmap
        regex: __meta_kubernetes_pod_label_(.+)
      - source_labels: [__meta_kubernetes_namespace]
        action: replace
        target_label: namespace
      - source_labels: [__meta_kubernetes_pod_name]
        action: replace
        target_label: pod_name
{{- end }}
`)

func chartsIstioTelemetryPrometheusTemplatesConfigmapYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryPrometheusTemplatesConfigmapYaml, nil
}

func chartsIstioTelemetryPrometheusTemplatesConfigmapYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryPrometheusTemplatesConfigmapYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/prometheus/templates/configmap.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryPrometheusTemplatesDeploymentYaml = []byte(`# TODO: the original template has service account, roles, etc
apiVersion: apps/v1
kind: Deployment
metadata:
  name: prometheus
  namespace: {{ .Release.Namespace }}
  labels:
    app: prometheus
    release: {{ .Release.Name }}
spec:
  replicas: {{ .Values.prometheus.replicaCount }}
  selector:
    matchLabels:
      app: prometheus
  template:
    metadata:
      labels:
        app: prometheus
        release: {{ .Release.Name }}
      annotations:
        sidecar.istio.io/inject: "false"
        {{- if .Values.prometheus.podAnnotations }}
{{ toYaml .Values.prometheus.podAnnotations | indent 8 }}
        {{- end }}
    spec:
      serviceAccountName: prometheus
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      containers:
        - name: prometheus
          image: "{{ .Values.prometheus.hub }}/{{ .Values.prometheus.image }}:{{ .Values.prometheus.tag }}"
          imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
          args:
            - '--storage.tsdb.retention={{ .Values.prometheus.retention }}'
            - '--config.file=/etc/prometheus/prometheus.yml'
          ports:
            - containerPort: 9090
              name: http
          livenessProbe:
            httpGet:
              path: /-/healthy
              port: 9090
          readinessProbe:
            httpGet:
              path: /-/ready
              port: 9090
          resources:
{{- if .Values.prometheus.resources }}
{{ toYaml .Values.prometheus.resources | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 12 }}
{{- end }}
          volumeMounts:
          - name: config-volume
            mountPath: /etc/prometheus
          - mountPath: /etc/istio-certs
            name: istio-certs
{{- if and .Values.prometheus.provisionPrometheusCert .Values.global.istiod.enabled }}
        - name: istio-proxy
          image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}"
          ports:
            - containerPort: 15090
              protocol: TCP
              name: http-envoy-prom
          args:
            - proxy
            - sidecar
            - --domain
            - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
            - --configPath
            - "/etc/istio/proxy"
            - --binaryPath
            - "/usr/local/bin/envoy"
            - --serviceCluster
            - "istio-proxy-prometheus"
            - --drainDuration
            - "45s"
            - --parentShutdownDuration
            - "1m0s"
            - --discoveryAddress
            {{- $namespace := .Values.global.configNamespace | default "istio-system" }}
            {{- if .Values.global.remotePilotAddress }}
            # Use the DNS hostname instead of the IP address. The discovery address needs to match the
            # SAN in istiod's cert. The istiod-remote.<namespace>.svc will resolve to the remotePilotAddress.
            - istiod-remote.{{ $namespace }}.svc:15012
            {{- else }}
            - istio-pilot.{{ $namespace }}.svc:15012
            {{- end }}
            {{- if .Values.global.proxy.logLevel }}
            - --proxyLogLevel={{ .Values.global.proxy.logLevel }}
            {{- end}}
            {{- if .Values.global.proxy.componentLogLevel }}
            - --proxyComponentLogLevel={{ .Values.global.proxy.componentLogLevel }}
            {{- end}}
            - --connectTimeout
            - "10s"
              {{- if .Values.global.proxy.envoyStatsd.enabled }}
            - --statsdUdpAddress
            - "{{ .ProxyConfig.StatsdUdpAddress }}"
              {{- end }}
            {{- if $.Values.global.proxy.envoyMetricsService.enabled }}
            - --envoyMetricsService
            {{- with  $.Values.global.proxy.envoyMetricsService }}
            - '{"address":"{{ .host }}:{{.port }}"{{ if .tlsSettings }},"tlsSettings":{{ .tlsSettings | toJson }}{{- end }}{{ if .tcpKeepalive }},"tcpKeepalive":{{ .tcpKeepalive | toJson }}{{- end }}}'
            {{- end }}
            {{- end}}
            {{- if $.Values.global.proxy.envoyAccessLogService.enabled }}
            - --envoyAccessLogService
            {{- with  $.Values.global.proxy.envoyAccessLogService }}
            - '{"address":"{{ .host }}:{{.port }}"{{ if .tlsSettings }},"tlsSettings":{{ .tlsSettings | toJson }}{{- end }}{{ if .tcpKeepalive }},"tcpKeepalive":{{ .tcpKeepalive | toJson }}{{- end }}}'
            {{- end }}
            {{- end }}
            - --proxyAdminPort
            - "15000"
              {{- if .Values.global.istiod.enabled }}
            - --controlPlaneAuthPolicy
            - NONE
              {{- else if .Values.global.controlPlaneSecurityEnabled }}
            - --controlPlaneAuthPolicy
            - MUTUAL_TLS
              {{- else }}
            - --controlPlaneAuthPolicy
            - NONE
              {{- end }}
            - --dnsRefreshRate
            - "300s"
            - --statusPort
            - "15020"
              {{- if .Values.global.trustDomain }}
            - --trust-domain={{ .Values.global.trustDomain }}
              {{- end }}
              {{- if .Values.global.logAsJson }}
            - --log_as_json
              {{- end }}
            - --controlPlaneBootstrap=false
          env:
            - name: OUTPUT_CERTS
              value: "/etc/istio-certs"
            - name: JWT_POLICY
              value: {{ .Values.global.jwtPolicy }}
            - name: PILOT_CERT_PROVIDER
              value: {{ .Values.global.pilotCertProvider }}
            # Temp, pending PR to make it default or based on the istiodAddr env
            - name: CA_ADDR
            {{- if .Values.global.caAddress }}
              value: {{ .Values.global.caAddress }}
            {{- else if .Values.global.configNamespace }}
              value: istio-pilot.{{ .Values.global.configNamespace }}.svc:15012
            {{- else }}
              value: istio-pilot.istio-system.svc:15012
              {{- end }}
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: INSTANCE_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: SERVICE_ACCOUNT
              valueFrom:
                fieldRef:
                  fieldPath: spec.serviceAccountName
            - name: HOST_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
            - name: ISTIO_META_POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: ISTIO_META_CONFIG_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
              {{- if .Values.global.network }}
            - name: ISTIO_META_NETWORK
              value: "{{ .Values.global.network }}"
              {{- end }}
              {{- if .Values.global.meshID }}
            - name: ISTIO_META_MESH_ID
              value: "{{ .Values.global.meshID }}"
              {{- else if .Values.global.trustDomain }}
            - name: ISTIO_META_MESH_ID
              value: "{{ .Values.global.trustDomain }}"
              {{- end }}
            - name: ISTIO_META_CLUSTER_ID
              value: "{{ .Values.global.multiCluster.clusterName | default `+"`"+`Kubernetes`+"`"+` }}"
          imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
          readinessProbe:
            failureThreshold: 30
            httpGet:
              path: /healthz/ready
              port: 15020
              scheme: HTTP
            initialDelaySeconds: 1
            periodSeconds: 2
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
              {{- if eq .Values.global.pilotCertProvider "istiod" }}
            - mountPath: /var/run/secrets/istio
              name: istiod-ca-cert
              {{- end }}
            - mountPath: /etc/istio/proxy
              name: istio-envoy
              {{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
            - mountPath: /var/run/secrets/tokens
              name: istio-token
              {{- end }}
            - mountPath: /etc/istio-certs/
              name: istio-certs
{{- end }}

      volumes:
      - name: config-volume
        configMap:
          name: prometheus

{{- if .Values.prometheus.provisionPrometheusCert }}
      - name: istio-certs
        emptyDir:
          medium: Memory
{{- else }}
      - name: istio-certs
        secret:
          defaultMode: 420
{{- if not .Values.security.enabled }}
          optional: true
{{- end }}
          secretName: istio.default
{{- end }}

{{- if .Values.prometheus.provisionPrometheusCert }}
      - emptyDir:
          medium: Memory
        name: istio-envoy
        {{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
      - name: istio-token
        projected:
          defaultMode: 420
          sources:
            - serviceAccountToken:
                path: istio-token
                expirationSeconds: 43200
                audience: {{ .Values.global.sds.token.aud }}
        {{- end }}
        {{- if eq .Values.global.pilotCertProvider "istiod" }}
      - name: istiod-ca-cert
        configMap:
          defaultMode: 420
          name: istio-ca-root-cert
        {{- end }}
        {{- if and (eq .Values.global.proxy.tracer "lightstep") .Values.global.tracer.lightstep.cacertPath }}
      - name: lightstep-certs
        secret:
          optional: true
          secretName: lightstep.cacert
        {{- end }}
{{- end }}

      affinity:
      {{- include "nodeaffinity" . | indent 6 }}
      {{- include "podAntiAffinity" . | indent 6 }}
{{- if .Values.prometheus.tolerations }}
      tolerations:
{{ toYaml .Values.prometheus.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}
`)

func chartsIstioTelemetryPrometheusTemplatesDeploymentYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryPrometheusTemplatesDeploymentYaml, nil
}

func chartsIstioTelemetryPrometheusTemplatesDeploymentYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryPrometheusTemplatesDeploymentYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/prometheus/templates/deployment.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryPrometheusTemplatesIngressYaml = []byte(`{{- if .Values.prometheus.ingress.enabled -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: prometheus
  namespace: {{ .Release.Namespace }}
  labels:
    app: prometheus
    release: {{ .Release.Name }}
  annotations:
    {{- range $key, $value := .Values.prometheus.ingress.annotations }}
      {{ $key }}: {{ $value | quote }}
    {{- end }}
spec:
  rules:
{{- if .Values.prometheus.ingress.hosts }}
    {{- range $host := .Values.prometheus.ingress.hosts }}
    - host: {{ $host }}
      http:
        paths:
          - path: {{ if $.Values.prometheus.contextPath }} {{ $.Values.prometheus.contextPath }} {{ else }} / {{ end }}
            backend:
              serviceName: prometheus
              servicePort: 9090
    {{- end -}}
{{- else }}
    - http:
        paths:
          - path: {{ if .Values.prometheus.contextPath }} {{ .Values.prometheus.contextPath }} {{ else }} / {{ end }}
            backend:
              serviceName: prometheus
              servicePort: 9090
{{- end }}
  {{- if .Values.prometheus.ingress.tls }}
  tls:
{{ toYaml .Values.prometheus.ingress.tls | indent 4 }}
  {{- end -}}
{{- end -}}
`)

func chartsIstioTelemetryPrometheusTemplatesIngressYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryPrometheusTemplatesIngressYaml, nil
}

func chartsIstioTelemetryPrometheusTemplatesIngressYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryPrometheusTemplatesIngressYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/prometheus/templates/ingress.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryPrometheusTemplatesServiceYaml = []byte(`apiVersion: v1
kind: Service
metadata:
  name: prometheus
  namespace: {{ .Release.Namespace }}
  annotations:
    prometheus.io/scrape: 'true'
    {{- if .Values.prometheus.service }}
    {{- range $key, $val := .Values.prometheus.service.annotations }}
    {{ $key }}: {{ $val | quote }}
    {{- end }}
    {{- end }}
  labels:
    app: prometheus
    release: {{ .Release.Name }}
spec:
  selector:
    app: prometheus
  ports:
  - name: http-prometheus
    protocol: TCP
    port: 9090

{{- if .Values.prometheus.service }}
# Using separate ingress for nodeport, to avoid conflict with pilot e2e test configs.
---
apiVersion: v1
kind: Service
metadata:
  name: prometheus-nodeport
  namespace: {{ .Release.Namespace }}
  labels:
    app: prometheus
    release: {{ .Release.Name }}
spec:
  type: NodePort
  ports:
  - port: 9090
    nodePort: {{ .Values.prometheus.service.nodePort.port }}
    name: http-prometheus
  selector:
    app: prometheus
{{- end }}
`)

func chartsIstioTelemetryPrometheusTemplatesServiceYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryPrometheusTemplatesServiceYaml, nil
}

func chartsIstioTelemetryPrometheusTemplatesServiceYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryPrometheusTemplatesServiceYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/prometheus/templates/service.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryPrometheusTemplatesServiceaccountYaml = []byte(`apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end }}
metadata:
  name: prometheus
  namespace: {{ .Release.Namespace }}
  labels:
    app: prometheus
    release: {{ .Release.Name }}
`)

func chartsIstioTelemetryPrometheusTemplatesServiceaccountYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryPrometheusTemplatesServiceaccountYaml, nil
}

func chartsIstioTelemetryPrometheusTemplatesServiceaccountYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryPrometheusTemplatesServiceaccountYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/prometheus/templates/serviceaccount.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryPrometheusTemplatesTestsTestPrometheusConnectionYaml = []byte(`{{- if .Values.global.enableHelmTest }}
apiVersion: v1
kind: Pod
metadata:
  name: prometheus-test
  namespace: {{ .Release.Namespace }}
  labels:
    app: prometheus-test
    release: {{ .Release.Name }}
    istio: prometheus
  annotations:
    sidecar.istio.io/inject: "false"
    helm.sh/hook: test-success
spec:
{{- if .Values.global.priorityClassName }}
  priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
  containers:
    - name: "prometheus-test"
      image: {{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}
      imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
      command: ['sh', '-c', 'for i in 1 2 3; do curl http://prometheus:9090/-/ready && exit 0 || sleep 15; done; exit 1']
  restartPolicy: Never
  affinity:
    {{- include "nodeaffinity" . | indent 4 }}
    {{- include "podAntiAffinity" . | indent 4 }}
{{- end }}
`)

func chartsIstioTelemetryPrometheusTemplatesTestsTestPrometheusConnectionYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryPrometheusTemplatesTestsTestPrometheusConnectionYaml, nil
}

func chartsIstioTelemetryPrometheusTemplatesTestsTestPrometheusConnectionYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryPrometheusTemplatesTestsTestPrometheusConnectionYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/prometheus/templates/tests/test-prometheus-connection.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryPrometheusValuesYaml = []byte(`prometheus:
  enabled: true
  replicaCount: 1
  hub: docker.io/prom
  image: prometheus
  tag: v2.15.1
  retention: 6h

  # Controls the frequency of prometheus scraping
  scrapeInterval: 15s

  contextPath: /prometheus

  ingress:
    enabled: false
    ## Used to create an Ingress record.
    hosts:
      - prometheus.local
    annotations:
      # kubernetes.io/ingress.class: nginx
      # kubernetes.io/tls-acme: "true"
    tls:
      # Secrets must be manually created in the namespace.
      # - secretName: prometheus-tls
      #   hosts:
      #     - prometheus.local

  # 1.2 it is disabled by default - it can be enabled for special cases, but would create port
  # conflicts. In general it is not recommended to use node ports for services, but use gateways instead.
#  service:
#    annotations: {}
#    nodePort:
#      enabled: false
#      port: 32090

  nodeSelector: {}
  tolerations: []
  podAnnotations: {}
  service: {}
  resources: {}
  datasources: []
  # Specify the pod anti-affinity that allows you to constrain which nodes
  # your pod is eligible to be scheduled based on labels on pods that are
  # already running on the node rather than based on labels on nodes.
  # There are currently two types of anti-affinity:
  #    "requiredDuringSchedulingIgnoredDuringExecution"
  #    "preferredDuringSchedulingIgnoredDuringExecution"
  # which denote "hard" vs. "soft" requirements, you can define your values
  # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
  # correspondingly.
  # For example:
  # podAntiAffinityLabelSelector:
  # - key: security
  #   operator: In
  #   values: S1,S2
  #   topologyKey: "kubernetes.io/hostname"
  # This pod anti-affinity rule says that the pod requires not to be scheduled
  # onto a node if that node is already running a pod with label having key
  # "security" and value "S1".
  podAntiAffinityLabelSelector: []
  podAntiAffinityTermLabelSelector: []

  # Configure whether provisions a certificate to Prometheus through Istio Agent.
  # When this option is set as true, a sidecar is deployed along Prometheus to
  # provision a certificate through Istio Agent to Prometheus. The provisioned certificate
  # is shared with Prometheus through mounted files.
  # When this option is set as false, this certificate provisioning mechanism is disabled.
  provisionPrometheusCert: true

# Indicate if Citadel is enabled, i.e., whether its generated certificates are available
security:
  enabled: true`)

func chartsIstioTelemetryPrometheusValuesYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryPrometheusValuesYaml, nil
}

func chartsIstioTelemetryPrometheusValuesYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryPrometheusValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/prometheus/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryPrometheusOperatorChartYaml = []byte(`apiVersion: v1
description: A Helm chart for Kubernetes
name: prometheus-operator
version: 1.1.0
appVersion: 2.3.1
tillerVersion: ">=2.7.2"
`)

func chartsIstioTelemetryPrometheusOperatorChartYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryPrometheusOperatorChartYaml, nil
}

func chartsIstioTelemetryPrometheusOperatorChartYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryPrometheusOperatorChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/prometheus-operator/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryPrometheusOperatorTemplates_affinityTpl = []byte(`{{/* affinity - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ */}}

{{- define "nodeaffinity" }}
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityRequiredDuringScheduling" . }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityPreferredDuringScheduling" . }}
{{- end }}

{{- define "nodeAffinityRequiredDuringScheduling" }}
      nodeSelectorTerms:
      - matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
        {{- range $key, $val := .Values.global.arch }}
          {{- if gt ($val | int) 0 }}
          - {{ $key | quote }}
          {{- end }}
        {{- end }}
        {{- $nodeSelector := default .Values.global.defaultNodeSelector .Values.prometheus.nodeSelector -}}
        {{- range $key, $val := $nodeSelector }}
        - key: {{ $key }}
          operator: In
          values:
          - {{ $val | quote }}
        {{- end }}
{{- end }}

{{- define "nodeAffinityPreferredDuringScheduling" }}
  {{- range $key, $val := .Values.global.arch }}
    {{- if gt ($val | int) 0 }}
    - weight: {{ $val | int }}
      preference:
        matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
          - {{ $key | quote }}
    {{- end }}
  {{- end }}
{{- end }}

{{- define "podAntiAffinity" }}
{{- if or .Values.prometheus.podAntiAffinityLabelSelector .Values.prometheus.podAntiAffinityTermLabelSelector}}
  podAntiAffinity:
    {{- if .Values.prometheus.podAntiAffinityLabelSelector }}
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityRequiredDuringScheduling" . }}
    {{- end }}
    {{- if .Values.prometheus.podAntiAffinityTermLabelSelector }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityPreferredDuringScheduling" . }}
    {{- end }}
{{- end }}
{{- end }}

{{- define "podAntiAffinityRequiredDuringScheduling" }}
    {{- range $index, $item := .Values.prometheus.podAntiAffinityLabelSelector }}
    - labelSelector:
        matchExpressions:
        - key: {{ $item.key }}
          operator: {{ $item.operator }}
          {{- if $item.values }}
          values:
          {{- $vals := split "," $item.values }}
          {{- range $i, $v := $vals }}
          - {{ $v | quote }}
          {{- end }}
          {{- end }}
      topologyKey: {{ $item.topologyKey }}
    {{- end }}
{{- end }}

{{- define "podAntiAffinityPreferredDuringScheduling" }}
    {{- range $index, $item := .Values.prometheus.podAntiAffinityTermLabelSelector }}
    - podAffinityTerm:
        labelSelector:
          matchExpressions:
          - key: {{ $item.key }}
            operator: {{ $item.operator }}
            {{- if $item.values }}
            values:
            {{- $vals := split "," $item.values }}
            {{- range $i, $v := $vals }}
            - {{ $v | quote }}
            {{- end }}
            {{- end }}
        topologyKey: {{ $item.topologyKey }}
      weight: 100
    {{- end }}
{{- end }}
`)

func chartsIstioTelemetryPrometheusOperatorTemplates_affinityTplBytes() ([]byte, error) {
	return _chartsIstioTelemetryPrometheusOperatorTemplates_affinityTpl, nil
}

func chartsIstioTelemetryPrometheusOperatorTemplates_affinityTpl() (*asset, error) {
	bytes, err := chartsIstioTelemetryPrometheusOperatorTemplates_affinityTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/prometheus-operator/templates/_affinity.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryPrometheusOperatorTemplatesPrometheusYaml = []byte(`{{- if .Values.prometheusOperator.createPrometheusResource }}
apiVersion: monitoring.coreos.com/v1
kind: Prometheus
metadata:
  name: prometheus
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
spec:
  image: "{{ .Values.prometheusOperator.hub }}/{{ .Values.prometheusOperator.image | default "prometheus" }}:{{ .Values.prometheusOperator.tag }}"
  version: {{ .Values.prometheusOperator.tag }}
  retention: {{ .Values.prometheusOperator.retention }}
  scrapeInterval: {{ .Values.prometheusOperator.scrapeInterval }}
  serviceAccountName: prometheus
  serviceMonitorSelector:
    any: true
  serviceMonitorNamespaceSelector:
    any: true
  secrets: [ istio.prometheus ]
  enableAdminAPI: false
{{- if .Values.global.priorityClassName }}
  priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
  affinity:
  {{- include "nodeaffinity" . | indent 2 }}
  {{- include "podAntiAffinity" . | indent 2 }}
{{- if .Values.prometheusOperator.tolerations }}
  tolerations:
{{ toYaml .Values.prometheusOperator.tolerations | indent 2 }}
{{- end }}
  podMetadata:
    labels:
      app: prometheus
      release: {{ .Release.Name }}
    annotations:
      sidecar.istio.io/inject: "false"
  resources:
    requests:
      memory: 400Mi
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: prometheus-{{ .Release.Namespace }}
  labels:
    app: prometheus
    release: {{ .Release.Name }}
rules:
- apiGroups: [""]
  resources:
  - nodes
  - services
  - endpoints
  - pods
  - nodes/proxy
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources:
  - configmaps
  verbs: ["get"]
- nonResourceURLs: ["/metrics"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: prometheus-{{ .Release.Namespace }}
  labels:
    app: prometheus
    release: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: prometheus-{{ .Release.Namespace }}
subjects:
- kind: ServiceAccount
  name: prometheus
  namespace: {{ .Release.Namespace }}
---
{{- if not .Values.prometheusOperator.service.nodePort.enabled }}
apiVersion: v1
kind: Service
metadata:
  name: prometheus
  namespace: {{ .Release.Namespace }}
  annotations:
    prometheus.io/scrape: 'true'
    {{- if .Values.service }}
    {{- range $key, $val := .Values.prometheusOperator.service.annotations }}
    {{ $key }}: {{ $val | quote }}
    {{- end }}
    {{- end }}
  labels:
    app: prometheus
    release: {{ .Release.Name }}
spec:
  selector:
    app: prometheus
  ports:
  - name: http-prometheus
    protocol: TCP
    port: 9090
{{- else }}
# Using separate ingress for nodeport, to avoid conflict with pilot e2e test configs.
apiVersion: v1
kind: Service
metadata:
  name: prometheus-nodeport
  namespace: {{ .Release.Namespace }}
  labels:
    app: prometheus
    release: {{ .Release.Name }}
spec:
  type: NodePort
  ports:
  - port: 9090
    nodePort: {{ .Values.prometheusOperator.service.nodePort.port }}
    name: http-prometheus
  selector:
    app: prometheus
{{- end }}
---
apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end }}
metadata:
  name: prometheus
  namespace: {{ .Release.Namespace }}
  labels:
    app: prometheus
    release: {{ .Release.Name }}
{{- end }}
`)

func chartsIstioTelemetryPrometheusOperatorTemplatesPrometheusYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryPrometheusOperatorTemplatesPrometheusYaml, nil
}

func chartsIstioTelemetryPrometheusOperatorTemplatesPrometheusYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryPrometheusOperatorTemplatesPrometheusYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/prometheus-operator/templates/prometheus.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryPrometheusOperatorTemplatesServicemonitorsYaml = []byte(`apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: istio-mesh-monitor
  namespace: {{ .Release.Namespace }}
  labels:
    monitoring: istio-mesh
    release: {{ .Release.Name }}
spec:
  selector:
    matchExpressions:
      - {key: istio, operator: In, values: [mixer]}
  namespaceSelector:
    matchNames:
      - {{ .Values.global.telemetryNamespace }}
  endpoints:
  - port: prometheus
    interval: {{ .Values.prometheusOperator.scrapeInterval }}
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: istio-component-monitor
  namespace: {{ .Release.Namespace }}
  labels:
    monitoring: istio-components
    release: {{ .Release.Name }}
spec:
  jobLabel: istio
  selector:
    matchExpressions:
      - {key: istio, operator: In, values: [mixer,pilot,galley,citadel,sidecar-injector]}
  namespaceSelector:
    any: true
  endpoints:
  - port: http-monitoring
    interval: {{ .Values.prometheusOperator.scrapeInterval }}
  - port: http-policy-monitoring
    interval: {{ .Values.prometheusOperator.scrapeInterval }}
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: envoy-stats-monitor
  namespace: {{ .Release.Namespace }}
  labels:
    monitoring: istio-proxies
    release: {{ .Release.Name }}
spec:
  selector:
    matchExpressions:
      - {key: istio-prometheus-ignore, operator: DoesNotExist}
  namespaceSelector:
    any: true
  jobLabel: envoy-stats
  endpoints:
  - path: /stats/prometheus
    targetPort: 15090
    interval: {{ .Values.prometheusOperator.scrapeInterval }}
    relabelings:
    - sourceLabels: [__meta_kubernetes_pod_container_port_name]
      action: keep
      regex: '.*-envoy-prom'
    - action: labeldrop
      regex: "__meta_kubernetes_pod_label_(.+)"
    - sourceLabels: [__meta_kubernetes_namespace]
      action: replace
      targetLabel: namespace
    - sourceLabels: [__meta_kubernetes_pod_name]
      action: replace
      targetLabel: pod_name
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: kubernetes-pods-monitor
  namespace: {{ .Release.Namespace }}
  labels:
    monitoring: kube-pods
    release: {{ .Release.Name }}
spec:
  selector:
    matchExpressions:
      - {key: istio-prometheus-ignore, operator: DoesNotExist}
  namespaceSelector:
    any: true
  jobLabel: kubernetes-pods
  endpoints:
  - interval: {{ .Values.prometheusOperator.scrapeInterval }}
    relabelings:
    - sourceLabels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
      action: keep
      regex: 'true'
    - sourceLabels: [__meta_kubernetes_pod_annotation_sidecar_istio_io_status, __meta_kubernetes_pod_annotation_prometheus_io_scheme]
      action: keep
      regex: '((;.*)|(.*;http)|(.??))'
    - sourceLabels: [__meta_kubernetes_pod_annotation_istio_mtls]
      action: drop
      regex: 'true'
    - sourceLabels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
      action: replace
      targetLabel: __metrics_path__
      regex: '(.+)'
    - sourceLabels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
      action: replace
      regex: '([^:]+)(?::\d+)?;(\d+)'
      replacement: $1:$2
      targetLabel: __address__
    - action: labelmap
      regex: '__meta_kubernetes_pod_label_(.+)'
    - sourceLabels: [__meta_kubernetes_namespace]
      action: replace
      targetLabel: namespace
    - sourceLabels: [__meta_kubernetes_pod_name]
      action: replace
      targetLabel: pod_name
---
{{- if .Values.security.enabled }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: kubernetes-pods-secure-monitor
  namespace: {{ .Release.Namespace }}
  labels:
    monitoring: kube-pods-secure
    release: {{ .Release.Name }}
spec:
  selector:
    matchExpressions:
      - {key: istio-prometheus-ignore, operator: DoesNotExist}
  namespaceSelector:
    any: true
  jobLabel: kubernetes-pods-secure
  endpoints:
  - interval: {{ .Values.prometheusOperator.scrapeInterval }}
    scheme: https
    tlsConfig:
      caFile: /etc/prometheus/secrets/istio.prometheus/root-cert.pem
      certFile: /etc/prometheus/secrets/istio.prometheus/cert-chain.pem
      keyFile: /etc/prometheus/secrets/istio.prometheus/key.pem
      insecureSkipVerify: true  # prometheus does not support secure naming.
    relabelings:
    - sourceLabels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
      action: keep
      regex: 'true'
    # sidecar status annotation is added by sidecar injector and
    # istio_workload_mtls_ability can be specifically placed on a pod to indicate its ability to receive mtls traffic.
    - sourceLabels: [__meta_kubernetes_pod_annotation_sidecar_istio_io_status, __meta_kubernetes_pod_annotation_istio_mtls]
      action: keep
      regex: '(([^;]+);([^;]*))|(([^;]*);(true))'
    - sourceLabels: [__meta_kubernetes_pod_annotation_prometheus_io_scheme]
      action: drop
      regex: '(http)'
    - sourceLabels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
      action: replace
      targetLabel: __metrics_path__
      regex: '(.+)'
    - sourceLabels: [__address__]  # Only keep address that is host:port
      action: keep    # otherwise an extra target with ':443' is added for https scheme
      regex: '([^:]+):(\d+)'
    - sourceLabels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
      action: replace
      regex: '([^:]+)(?::\d+)?;(\d+)'
      replacement: $1:$2
      targetLabel: __address__
    - action: labelmap
      regex: '__meta_kubernetes_pod_label_(.+)'
    - sourceLabels: [__meta_kubernetes_namespace]
      action: replace
      targetLabel: namespace
    - sourceLabels: [__meta_kubernetes_pod_name]
      action: replace
      targetLabel: pod_name
{{- end }}
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: kubernetes-services-monitor
  namespace: {{ .Release.Namespace }}
  labels:
    monitoring: kube-services
    release: {{ .Release.Name }}
spec:
  selector:
    matchExpressions:
      - {key: istio-prometheus-ignore, operator: DoesNotExist}
  namespaceSelector:
    any: true
  jobLabel: kubernetes-services
  endpoints:
  - interval: {{ .Values.prometheusOperator.scrapeInterval }}
    relabelings:
    - sourceLabels: [__meta_kubernetes_service_annotation_prometheus_io_scrape]
      action: keep
      regex: 'true'
    - sourceLabels: [__meta_kubernetes_pod_annotation_sidecar_istio_io_status, __meta_kubernetes_service_annotation_prometheus_io_scheme]
      action: keep
      regex: '((;.*)|(.*;http)|(.??))'
    - sourceLabels: [__meta_kubernetes_pod_annotation_istio_mtls]
      action: drop
      regex: 'true'
    - sourceLabels: [__meta_kubernetes_service_annotation_prometheus_io_path]
      action: replace
      targetLabel: __metrics_path__
      regex: '(.+)'
    - sourceLabels: [__address__, __meta_kubernetes_service_annotation_prometheus_io_port]
      action: replace
      regex: '([^:]+)(?::\d+)?;(\d+)'
      replacement: $1:$2
      targetLabel: __address__
    - action: labelmap
      regex: '__meta_kubernetes_pod_label_(.+)'
    - sourceLabels: [__meta_kubernetes_namespace]
      action: replace
      targetLabel: namespace
    - sourceLabels: [__meta_kubernetes_pod_name]
      action: replace
      targetLabel: pod_name
---
{{- if .Values.security.enabled }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: kubernetes-services-secure-monitor
  namespace: {{ .Release.Namespace }}
  labels:
    monitoring: kube-services-secure
    release: {{ .Release.Name }}
spec:
  selector:
    matchExpressions:
      - {key: istio-prometheus-ignore, operator: DoesNotExist}
  namespaceSelector:
    any: true
  jobLabel: kubernetes-services-secure
  endpoints:
  - interval: {{ .Values.prometheusOperator.scrapeInterval }}
    scheme: https
    tlsConfig:
      caFile: /etc/prometheus/secrets/istio.prometheus/root-cert.pem
      certFile: /etc/prometheus/secrets/istio.prometheus/cert-chain.pem
      keyFile: /etc/prometheus/secrets/istio.prometheus/key.pem
      insecureSkipVerify: true  # prometheus does not support secure naming.
    relabelings:
    - sourceLabels: [__meta_kubernetes_service_annotation_prometheus_io_scrape]
      action: keep
      regex: 'true'
    # sidecar status annotation is added by sidecar injector and
    # istio_workload_mtls_ability can be specifically placed on a pod to indicate its ability to receive mtls traffic.
    - sourceLabels: [__meta_kubernetes_pod_annotation_sidecar_istio_io_status, __meta_kubernetes_pod_annotation_istio_mtls]
      action: keep
      regex: '(([^;]+);([^;]*))|(([^;]*);(true))'
    - sourceLabels: [__meta_kubernetes_service_annotation_prometheus_io_scheme]
      action: drop
      regex: '(http)'
    - sourceLabels: [__meta_kubernetes_service_annotation_prometheus_io_path]
      action: replace
      targetLabel: __metrics_path__
      regex: '(.+)'
    - sourceLabels: [__address__]  # Only keep address that is host:port
      action: keep    # otherwise an extra target with ':443' is added for https scheme
      regex: '([^:]+):(\d+)'
    - sourceLabels: [__address__, __meta_kubernetes_service_annotation_prometheus_io_port]
      action: replace
      regex: '([^:]+)(?::\d+)?;(\d+)'
      replacement: $1:$2
      targetLabel: __address__
    - action: labelmap
      regex: '__meta_kubernetes_pod_label_(.+)'
    - sourceLabels: [__meta_kubernetes_namespace]
      action: replace
      targetLabel: namespace
    - sourceLabels: [__meta_kubernetes_pod_name]
      action: replace
      targetLabel: pod_name
{{- end }}
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: kubelet
  namespace: {{ .Release.Namespace }}
  labels:
    monitoring: kubelet-monitor
    release: {{ .Release.Name }}
spec:
  endpoints:
  - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
    honorLabels: true
    interval: {{ .Values.prometheusOperator.scrapeInterval }}
    port: http-metrics
    scheme: http
    tlsConfig:
      insecureSkipVerify: true
  - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
    honorLabels: true
    interval: {{ .Values.prometheusOperator.scrapeInterval }}
    relabelings:
    - sourceLabels: [job]
      action: replace
      replacement: kubernetes-cadvisor
      targetLabel: job
    metricRelabelings:
    - action: drop
      regex: container_(network_tcp_usage_total|network_udp_usage_total|tasks_state|cpu_load_average_10s)
      sourceLabels:
      - __name__
    path: /metrics/cadvisor
    port: http-metrics
    scheme: http
    tlsConfig:
      insecureSkipVerify: true
  jobLabel: k8s-app
  namespaceSelector:
    matchNames:
    - kube-system
  selector:
    matchLabels:
      k8s-app: kubelet
`)

func chartsIstioTelemetryPrometheusOperatorTemplatesServicemonitorsYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryPrometheusOperatorTemplatesServicemonitorsYaml, nil
}

func chartsIstioTelemetryPrometheusOperatorTemplatesServicemonitorsYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryPrometheusOperatorTemplatesServicemonitorsYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/prometheus-operator/templates/servicemonitors.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryPrometheusOperatorValuesYaml = []byte(`prometheusOperator:
  # Controls the default scrape interval used in the ServiceMonitors
  scrapeInterval: 15s

  # Enabling this option will generate a Prometheus resource, causing the operator
  # to create a prometheus deployment according to the generated spec. It will also
  # create a service definition, destination rules, cluster roles and bindings, and
  # a service account. Only use this option if you have not already created and configured
  # a prometheus resource and/or you desire a distinct prometheus resource for Istio.
  createPrometheusResource: false
  hub: docker.io/prom
  tag: v2.15.1
  retention: 6h

  service:
    annotations: {}
    nodePort:
      enabled: false
      port: 32090

  nodeSelector: {}
  tolerations: []

  # Specify the pod anti-affinity that allows you to constrain which nodes
  # your pod is eligible to be scheduled based on labels on pods that are
  # already running on the node rather than based on labels on nodes.
  # There are currently two types of anti-affinity:
  #    "requiredDuringSchedulingIgnoredDuringExecution"
  #    "preferredDuringSchedulingIgnoredDuringExecution"
  # which denote "hard" vs. "soft" requirements, you can define your values
  # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
  # correspondingly.
  # For example:
  # podAntiAffinityLabelSelector:
  # - key: security
  #   operator: In
  #   values: S1,S2
  #   topologyKey: "kubernetes.io/hostname"
  # This pod anti-affinity rule says that the pod requires not to be scheduled
  # onto a node if that node is already running a pod with label having key
  # "security" and value "S1".
  podAntiAffinityLabelSelector: []
  podAntiAffinityTermLabelSelector: []

# Indicate if Citadel is enabled, i.e., whether its generated certificates are available
security:
  enabled: true`)

func chartsIstioTelemetryPrometheusOperatorValuesYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryPrometheusOperatorValuesYaml, nil
}

func chartsIstioTelemetryPrometheusOperatorValuesYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryPrometheusOperatorValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/prometheus-operator/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryTracingChartYaml = []byte(`apiVersion: v1
description: A Helm chart for tracing
name: tracing
version: 1.1.0
appVersion: 1.5.1
tillerVersion: ">=2.7.2"
`)

func chartsIstioTelemetryTracingChartYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryTracingChartYaml, nil
}

func chartsIstioTelemetryTracingChartYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryTracingChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/tracing/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryTracingTemplates_affinityTpl = []byte(`{{/* affinity - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ */}}

{{- define "nodeaffinity" }}
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityRequiredDuringScheduling" . }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityPreferredDuringScheduling" . }}
{{- end }}

{{- define "nodeAffinityRequiredDuringScheduling" }}
      nodeSelectorTerms:
      - matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
        {{- range $key, $val := .Values.global.arch }}
          {{- if gt ($val | int) 0 }}
          - {{ $key | quote }}
          {{- end }}
        {{- end }}
        {{- $nodeSelector := default .Values.global.defaultNodeSelector .Values.tracing.nodeSelector -}}
        {{- range $key, $val := $nodeSelector }}
        - key: {{ $key }}
          operator: In
          values:
          - {{ $val | quote }}
        {{- end }}
{{- end }}

{{- define "nodeAffinityPreferredDuringScheduling" }}
  {{- range $key, $val := .Values.global.arch }}
    {{- if gt ($val | int) 0 }}
    - weight: {{ $val | int }}
      preference:
        matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
          - {{ $key | quote }}
    {{- end }}
  {{- end }}
{{- end }}

{{- define "podAntiAffinity" }}
{{- if or .Values.tracing.podAntiAffinityLabelSelector .Values.tracing.podAntiAffinityTermLabelSelector}}
  podAntiAffinity:
    {{- if .Values.tracing.podAntiAffinityLabelSelector }}
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityRequiredDuringScheduling" . }}
    {{- end }}
    {{- if or .Values.tracing.podAntiAffinityTermLabelSelector}}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityPreferredDuringScheduling" . }}
    {{- end }}
{{- end }}
{{- end }}

{{- define "podAntiAffinityRequiredDuringScheduling" }}
    {{- range $index, $item := .Values.tracing.podAntiAffinityLabelSelector }}
    - labelSelector:
        matchExpressions:
        - key: {{ $item.key }}
          operator: {{ $item.operator }}
          {{- if $item.values }}
          values:
          {{- $vals := split "," $item.values }}
          {{- range $i, $v := $vals }}
          - {{ $v | quote }}
          {{- end }}
          {{- end }}
      topologyKey: {{ $item.topologyKey }}
    {{- end }}
{{- end }}

{{- define "podAntiAffinityPreferredDuringScheduling" }}
    {{- range $index, $item := .Values.tracing.podAntiAffinityTermLabelSelector }}
    - podAffinityTerm:
        labelSelector:
          matchExpressions:
          - key: {{ $item.key }}
            operator: {{ $item.operator }}
            {{- if $item.values }}
            values:
            {{- $vals := split "," $item.values }}
            {{- range $i, $v := $vals }}
            - {{ $v | quote }}
            {{- end }}
            {{- end }}
        topologyKey: {{ $item.topologyKey }}
      weight: 100
    {{- end }}
{{- end }}`)

func chartsIstioTelemetryTracingTemplates_affinityTplBytes() ([]byte, error) {
	return _chartsIstioTelemetryTracingTemplates_affinityTpl, nil
}

func chartsIstioTelemetryTracingTemplates_affinityTpl() (*asset, error) {
	bytes, err := chartsIstioTelemetryTracingTemplates_affinityTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/tracing/templates/_affinity.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryTracingTemplatesDeploymentJaegerYaml = []byte(`{{ if eq .Values.tracing.provider "jaeger" }}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: istio-tracing
  namespace: {{ .Release.Namespace }}
  labels:
    app: jaeger
    release: {{ .Release.Name }}
spec:
  selector:
    matchLabels:
      app: jaeger
  template:
    metadata:
      labels:
        app: jaeger
        release: {{ .Release.Name }}
      annotations:
        sidecar.istio.io/inject: "false"
        prometheus.io/scrape: "true"
        prometheus.io/port: "14269"
        {{- if .Values.tracing.jaeger.podAnnotations }}
{{ toYaml .Values.tracing.jaeger.podAnnotations | indent 8 }}
        {{- end }}
    spec:
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
{{- if .Values.global.imagePullSecrets }}
      imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
        - name: {{ . }}
{{- end }}
{{- end }}
      containers:
        - name: jaeger
          image: "{{ .Values.tracing.jaeger.hub }}/{{ .Values.tracing.jaeger.image }}:{{ .Values.tracing.jaeger.tag }}"
          imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
          ports:
            - containerPort: 9411
            - containerPort: 16686
            - containerPort: 14250
            - containerPort: 14267
            - containerPort: 14268
            - containerPort: 14269
            - containerPort: 5775
              protocol: UDP
            - containerPort: 6831
              protocol: UDP
            - containerPort: 6832
              protocol: UDP
          env:
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          {{- if eq .Values.tracing.jaeger.spanStorageType "badger" }}
          - name: BADGER_EPHEMERAL
            value: "false"
          - name: SPAN_STORAGE_TYPE
            value: "badger"
          - name: BADGER_DIRECTORY_VALUE
            value: "/badger/data"
          - name: BADGER_DIRECTORY_KEY
            value: "/badger/key"
          {{- end }}
          - name: COLLECTOR_ZIPKIN_HTTP_PORT
            value: "9411"
          - name: MEMORY_MAX_TRACES
            value: "{{ .Values.tracing.jaeger.memory.max_traces }}"
          - name: QUERY_BASE_PATH
            value: {{ if .Values.tracing.contextPath }} {{ .Values.tracing.contextPath }} {{ else }} /{{ .Values.tracing.provider }} {{ end }}
          livenessProbe:
            httpGet:
              path: /
              port: 14269
          readinessProbe:
            httpGet:
              path: /
              port: 14269
{{- if eq .Values.tracing.jaeger.spanStorageType "badger" }}
          volumeMounts:
          - name: data
            mountPath: /badger
{{- end }}
          resources:
{{- if .Values.tracing.jaeger.resources }}
{{ toYaml .Values.tracing.jaeger.resources | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 12 }}
{{- end }}
      affinity:
      {{- include "nodeaffinity" . | indent 6 }}
      {{- include "podAntiAffinity" . | indent 6 }}
{{- if .Values.tracing.tolerations }}
      tolerations:
{{ toYaml .Values.tracing.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}
{{- if eq .Values.tracing.jaeger.spanStorageType "badger" }}
      volumes:
      - name: data
{{- if .Values.tracing.jaeger.persist }}
        persistentVolumeClaim:
          claimName: istio-jaeger-pvc
{{- else }}
        emptyDir: {}
{{- end }}
{{- end }}
{{ end }}
`)

func chartsIstioTelemetryTracingTemplatesDeploymentJaegerYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryTracingTemplatesDeploymentJaegerYaml, nil
}

func chartsIstioTelemetryTracingTemplatesDeploymentJaegerYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryTracingTemplatesDeploymentJaegerYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/tracing/templates/deployment-jaeger.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryTracingTemplatesDeploymentOpencensusYaml = []byte(`{{ if eq .Values.tracing.provider "opencensus" }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: oc-collector-config
  labels:
    app: opencensus
    component: oc-collector-config
data:
  oc-collector-config: |
    receivers:
      zipkin:
        address: "127.0.0.1:9411"
    exporters:
{{- if .Values.tracing.opencensus.exporters }}
{{ toYaml .Values.tracing.opencensus.exporters | indent 6 }}
{{- end }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: istio-tracing
  namespace: {{ .Release.Namespace }}
  labels:
    app: opencensus
    component: oc-collector
    release: {{ .Release.Name }}
spec:
  selector:
    matchLabels:
      app: opencensus
  minReadySeconds: 5
  progressDeadlineSeconds: 120
  replicas: 1
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
        prometheus.io/path: "/metrics"
        prometheus.io/port: "8888"
        prometheus.io/scrape: "true"
        {{- if .Values.tracing.opencensus.podAnnotations }}
{{ toYaml .Values.tracing.opencensus.podAnnotations | indent 8 }}
        {{- end }}
      labels:
        app: opencensus
        component: oc-collector
    spec:
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
{{- if .Values.global.imagePullSecrets }}
      imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
        - name: {{ . }}
{{- end }}
{{- end }}
      containers:
      - name: oc-collector
        image: "{{ .Values.tracing.opencensus.hub }}/opencensus-collector:{{ .Values.tracing.opencensus.tag }}"
        imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
        command:
          - "/occollector_linux"
          - "--config=/conf/oc-collector-config.yaml"
        ports:
        - containerPort: 9411
        resources:
{{- if .Values.tracing.opencensus.resources }}
{{ toYaml .Values.tracing.opencensus.resources | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 12 }}
{{- end }}
        volumeMounts:
        - name: oc-collector-config-vol
          mountPath: /conf
        livenessProbe:
          httpGet:
            path: /
            port: 13133
        readinessProbe:
          httpGet:
            path: /
            port: 13133
        env:
        - name: GOGC
          value: "80"
      volumes:
        - configMap:
            name: oc-collector-config
            items:
              - key: oc-collector-config
                path: oc-collector-config.yaml
          name: oc-collector-config-vol
      affinity:
      {{- include "nodeaffinity" . | indent 6 }}
      {{- include "podAntiAffinity" . | indent 6 }}
{{- if .Values.tracing.tolerations }}
      tolerations:
{{ toYaml .Values.tracing.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}
{{ end }}
`)

func chartsIstioTelemetryTracingTemplatesDeploymentOpencensusYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryTracingTemplatesDeploymentOpencensusYaml, nil
}

func chartsIstioTelemetryTracingTemplatesDeploymentOpencensusYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryTracingTemplatesDeploymentOpencensusYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/tracing/templates/deployment-opencensus.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryTracingTemplatesDeploymentZipkinYaml = []byte(`{{ if eq .Values.tracing.provider "zipkin" }}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: istio-tracing
  namespace: {{ .Release.Namespace }}
  labels:
    app: zipkin
    release: {{ .Release.Name }}
spec:
  selector:
    matchLabels:
      app: zipkin
  template:
    metadata:
      labels:
        app: zipkin
        release: {{ .Release.Name }}
      annotations:
        sidecar.istio.io/inject: "false"
        scheduler.alpha.kubernetes.io/critical-pod: ""
        {{- if .Values.tracing.zipkin.podAnnotations }}
{{ toYaml .Values.tracing.zipkin.podAnnotations | indent 8 }}
        {{- end }}
    spec:
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
{{- if .Values.global.imagePullSecrets }}
      imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
        - name: {{ . }}
{{- end }}
{{- end }}
      containers:
        - name: zipkin
          image: "{{ .Values.tracing.zipkin.hub }}/{{ .Values.tracing.zipkin.image }}:{{ .Values.tracing.zipkin.tag }}"
          imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
          ports:
            - containerPort: {{ .Values.tracing.zipkin.queryPort }}
          livenessProbe:
            initialDelaySeconds: {{ .Values.tracing.zipkin.probeStartupDelay }}
            tcpSocket:
              port: {{ .Values.tracing.zipkin.queryPort }}
          readinessProbe:
            initialDelaySeconds: {{ .Values.tracing.zipkin.probeStartupDelay }}
            httpGet:
              path: /health
              port: {{ .Values.tracing.zipkin.queryPort }}
          resources:
{{- if .Values.tracing.zipkin.resources }}
{{ toYaml .Values.tracing.zipkin.resources | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 12 }}
{{- end }}
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: QUERY_PORT
              value: "{{ .Values.tracing.zipkin.queryPort }}"
            - name: JAVA_OPTS
              value: "-XX:ConcGCThreads={{ .Values.tracing.zipkin.node.cpus }} -XX:ParallelGCThreads={{ .Values.tracing.zipkin.node.cpus }} -Djava.util.concurrent.ForkJoinPool.common.parallelism={{ .Values.tracing.zipkin.node.cpus }} -Xms{{ .Values.tracing.zipkin.javaOptsHeap }}M -Xmx{{ .Values.tracing.zipkin.javaOptsHeap }}M -XX:+UseG1GC -server"
            - name: STORAGE_METHOD
              value: "mem"
            - name: ZIPKIN_STORAGE_MEM_MAXSPANS
              value: "{{ .Values.tracing.zipkin.maxSpans }}"
      affinity:
      {{- include "nodeaffinity" . | indent 6 }}
      {{- include "podAntiAffinity" . | indent 6 }}
{{- if .Values.tracing.tolerations }}
      tolerations:
{{ toYaml .Values.tracing.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}
{{ end }}
`)

func chartsIstioTelemetryTracingTemplatesDeploymentZipkinYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryTracingTemplatesDeploymentZipkinYaml, nil
}

func chartsIstioTelemetryTracingTemplatesDeploymentZipkinYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryTracingTemplatesDeploymentZipkinYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/tracing/templates/deployment-zipkin.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryTracingTemplatesPvcYaml = []byte(`{{- if eq .Values.tracing.provider "jaeger" }}
{{- if .Values.tracing.jaeger.persist }}
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: istio-jaeger-pvc
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ .Values.tracing.provider }}
    release: {{ .Release.Name }}
spec:
  storageClassName: {{ .Values.tracing.jaeger.storageClassName }}
  accessModes:
    - {{ .Values.tracing.jaeger.accessMode }}
  resources:
    requests:
      storage: 5Gi
{{- end }}
{{- end }}
`)

func chartsIstioTelemetryTracingTemplatesPvcYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryTracingTemplatesPvcYaml, nil
}

func chartsIstioTelemetryTracingTemplatesPvcYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryTracingTemplatesPvcYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/tracing/templates/pvc.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryTracingTemplatesServiceJaegerYaml = []byte(`{{ if eq .Values.tracing.provider "jaeger" }}
apiVersion: v1
kind: Service
metadata:
  name: jaeger-query
  namespace: {{ .Release.Namespace }}
  annotations:
    {{- range $key, $val := .Values.tracing.service.annotations }}
    {{ $key }}: {{ $val | quote }}
    {{- end }}
  labels:
    app: jaeger
    jaeger-infra: jaeger-service
    release: {{ .Release.Name }}
spec:
  ports:
    - name: query-http
      port: 16686
      protocol: TCP
      targetPort: 16686
  selector:
    app: jaeger
---
apiVersion: v1
kind: Service
metadata:
  name: jaeger-collector
  namespace: {{ .Release.Namespace }}
  labels:
    app: jaeger
    jaeger-infra: collector-service
    release: {{ .Release.Name }}
spec:
  ports:
  - name: jaeger-collector-tchannel
    port: 14267
    protocol: TCP
    targetPort: 14267
  - name: jaeger-collector-http
    port: 14268
    targetPort: 14268
    protocol: TCP
  - name: jaeger-collector-grpc
    port: 14250
    targetPort: 14250
    protocol: TCP
  selector:
    app: jaeger
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  name: jaeger-collector-headless
  namespace: {{ .Release.Namespace }}
  labels:
    app: jaeger
    jaeger-infra: collector-service
    release: {{ .Release.Name }}
spec:
  ports:
  - name: jaeger-collector-grpc
    port: 14250
    targetPort: 14250
    protocol: TCP
  selector:
    app: jaeger
  clusterIP: None
---
apiVersion: v1
kind: Service
metadata:
  name: jaeger-agent
  namespace: {{ .Release.Namespace }}
  labels:
    app: jaeger
    jaeger-infra: agent-service
    release: {{ .Release.Name }}
spec:
  ports:
  - name: agent-zipkin-thrift
    port: 5775
    protocol: UDP
    targetPort: 5775
  - name: agent-compact
    port: 6831
    protocol: UDP
    targetPort: 6831
  - name: agent-binary
    port: 6832
    protocol: UDP
    targetPort: 6832
  clusterIP: None
  selector:
    app: jaeger
{{ end }}
`)

func chartsIstioTelemetryTracingTemplatesServiceJaegerYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryTracingTemplatesServiceJaegerYaml, nil
}

func chartsIstioTelemetryTracingTemplatesServiceJaegerYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryTracingTemplatesServiceJaegerYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/tracing/templates/service-jaeger.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryTracingTemplatesServiceYaml = []byte(`apiVersion: v1
kind: Service
metadata:
  name: zipkin
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ .Values.tracing.provider }}
    release: {{ .Release.Name }}
spec:
  ports:
    - port: {{ .Values.tracing.zipkin.queryPort }}
      targetPort: {{ .Values.tracing.zipkin.queryPort }}
      protocol: TCP
      name: {{ .Values.tracing.service.name }}
  selector:
    app: {{ .Values.tracing.provider }}
---
{{- if ne .Values.tracing.provider "opencensus"}}
apiVersion: v1
kind: Service
metadata:
  name: tracing
  namespace: {{ .Release.Namespace }}
  annotations:
    {{- range $key, $val := .Values.tracing.service.annotations }}
    {{ $key }}: {{ $val | quote }}
    {{- end }}
  labels:
    app: {{ .Values.tracing.provider }}
    release: {{ .Release.Name }}
spec:
  type: {{ .Values.tracing.service.type }}
  ports:
    - name: {{ .Values.tracing.service.name }}
      port: 80
      protocol: TCP
{{ if eq .Values.tracing.provider "jaeger" }}
      targetPort: 16686
{{ else }}
      targetPort: {{ .Values.tracing.zipkin.queryPort }}
{{ end}}
  selector:
    app: {{ .Values.tracing.provider }}
{{- end }}
`)

func chartsIstioTelemetryTracingTemplatesServiceYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryTracingTemplatesServiceYaml, nil
}

func chartsIstioTelemetryTracingTemplatesServiceYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryTracingTemplatesServiceYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/tracing/templates/service.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstioTelemetryTracingValuesYaml = []byte(`#
# addon tracing configuration
#
tracing:
  enabled: false

  provider: jaeger
  nodeSelector: {}
  tolerations: []

  # Specify the pod anti-affinity that allows you to constrain which nodes
  # your pod is eligible to be scheduled based on labels on pods that are
  # already running on the node rather than based on labels on nodes.
  # There are currently two types of anti-affinity:
  #    "requiredDuringSchedulingIgnoredDuringExecution"
  #    "preferredDuringSchedulingIgnoredDuringExecution"
  # which denote "hard" vs. "soft" requirements, you can define your values
  # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
  # correspondingly.
  # For example:
  # podAntiAffinityLabelSelector:
  # - key: security
  #   operator: In
  #   values: S1,S2
  #   topologyKey: "kubernetes.io/hostname"
  # This pod anti-affinity rule says that the pod requires not to be scheduled
  # onto a node if that node is already running a pod with label having key
  # "security" and value "S1".
  podAntiAffinityLabelSelector: []
  podAntiAffinityTermLabelSelector: []

  contextPath: ""


  jaeger:
    hub: docker.io/jaegertracing
    image: all-in-one
    tag: 1.16
    memory:
      max_traces: 50000
    resources: {}
    # spanStorageType value can be "memory" and "badger" for all-in-one image
    spanStorageType: badger
    persist: false
    storageClassName: ""
    accessMode: ReadWriteMany
    podAnnotations: {}

  zipkin:
    hub: docker.io/openzipkin
    image: zipkin
    tag: 2.14.2
    probeStartupDelay: 200
    queryPort: 9411
    resources:
      limits:
        cpu: 300m
        memory: 900Mi
      requests:
        cpu: 150m
        memory: 900Mi
    javaOptsHeap: 700
    # From: https://github.com/openzipkin/zipkin/blob/master/zipkin-server/src/main/resources/zipkin-server-shared.yml#L51
    # Maximum number of spans to keep in memory.  When exceeded, oldest traces (and their spans) will be purged.
    # A safe estimate is 1K of memory per span (each span with 2 annotations + 1 binary annotation), plus
    # 100 MB for a safety buffer.  You'll need to verify in your own environment.
    maxSpans: 500000
    node:
      cpus: 2
    podAnnotations: {}

  opencensus:
    hub: docker.io/omnition
    tag: 0.1.9
    resources:
      limits:
        cpu: 1
        memory: 2Gi
      requests:
        cpu: 200m
        memory: 400Mi
    exporters:
      stackdriver:
        enable_tracing: true
    podAnnotations: {}

  service:
    annotations: {}
    name: http-query
    type: ClusterIP
    externalPort: 80

  ingress:
    enabled: false
    # Used to create an Ingress record.
    hosts:
    # - tracing.local
    annotations:
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
    tls:
    # Secrets must be manually created in the namespace.
    # - secretName: tracing-tls
    #   hosts:
    #     - tracing.local

`)

func chartsIstioTelemetryTracingValuesYamlBytes() ([]byte, error) {
	return _chartsIstioTelemetryTracingValuesYaml, nil
}

func chartsIstioTelemetryTracingValuesYaml() (*asset, error) {
	bytes, err := chartsIstioTelemetryTracingValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istio-telemetry/tracing/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstiocorednsChartYaml = []byte(`apiVersion: v1
description: Istio CoreDNS provides DNS resolution for services in multicluster setups.
name: istiocoredns
version: 1.1.0
appVersion: 0.1
tillerVersion: ">=2.7.2"
`)

func chartsIstiocorednsChartYamlBytes() ([]byte, error) {
	return _chartsIstiocorednsChartYaml, nil
}

func chartsIstiocorednsChartYaml() (*asset, error) {
	bytes, err := chartsIstiocorednsChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istiocoredns/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstiocorednsTemplates_affinityTpl = []byte(`{{/* affinity - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ */}}

{{- define "nodeaffinity" }}
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityRequiredDuringScheduling" . }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityPreferredDuringScheduling" . }}
{{- end }}

{{- define "nodeAffinityRequiredDuringScheduling" }}
      nodeSelectorTerms:
      - matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
        {{- range $key, $val := .Values.global.arch }}
          {{- if gt ($val | int) 0 }}
          - {{ $key | quote }}
          {{- end }}
        {{- end }}
        {{- $nodeSelector := default .Values.global.defaultNodeSelector .Values.istiocoredns.nodeSelector -}}
        {{- range $key, $val := $nodeSelector }}
        - key: {{ $key }}
          operator: In
          values:
          - {{ $val | quote }}
        {{- end }}
{{- end }}

{{- define "nodeAffinityPreferredDuringScheduling" }}
  {{- range $key, $val := .Values.global.arch }}
    {{- if gt ($val | int) 0 }}
    - weight: {{ $val | int }}
      preference:
        matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
          - {{ $key | quote }}
    {{- end }}
  {{- end }}
{{- end }}

{{- define "podAntiAffinity" }}
{{- if or .Values.istiocoredns.podAntiAffinityLabelSelector .Values.istiocoredns.podAntiAffinityTermLabelSelector}}
  podAntiAffinity:
    {{- if .Values.istiocoredns.podAntiAffinityLabelSelector }}
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityRequiredDuringScheduling" . }}
    {{- end }}
    {{- if .Values.istiocoredns.podAntiAffinityTermLabelSelector }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityPreferredDuringScheduling" . }}
    {{- end }}
{{- end }}
{{- end }}

{{- define "podAntiAffinityRequiredDuringScheduling" }}
    {{- range $index, $item := .Values.istiocoredns.podAntiAffinityLabelSelector }}
    - labelSelector:
        matchExpressions:
        - key: {{ $item.key }}
          operator: {{ $item.operator }}
          {{- if $item.values }}
          values:
          {{- $vals := split "," $item.values }}
          {{- range $i, $v := $vals }}
          - {{ $v | quote }}
          {{- end }}
          {{- end }}
      topologyKey: {{ $item.topologyKey }}
    {{- end }}
{{- end }}

{{- define "podAntiAffinityPreferredDuringScheduling" }}
    {{- range $index, $item := .Values.istiocoredns.podAntiAffinityTermLabelSelector }}
    - podAffinityTerm:
        labelSelector:
          matchExpressions:
          - key: {{ $item.key }}
            operator: {{ $item.operator }}
            {{- if $item.values }}
            values:
            {{- $vals := split "," $item.values }}
            {{- range $i, $v := $vals }}
            - {{ $v | quote }}
            {{- end }}
            {{- end }}
        topologyKey: {{ $item.topologyKey }}
      weight: 100
    {{- end }}
{{- end }}
`)

func chartsIstiocorednsTemplates_affinityTplBytes() ([]byte, error) {
	return _chartsIstiocorednsTemplates_affinityTpl, nil
}

func chartsIstiocorednsTemplates_affinityTpl() (*asset, error) {
	bytes, err := chartsIstiocorednsTemplates_affinityTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istiocoredns/templates/_affinity.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstiocorednsTemplatesClusterroleYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istiocoredns
  labels:
    app: istiocoredns
    release: {{ .Release.Name }}
rules:
- apiGroups: ["networking.istio.io"]
  resources: ["*"]
  verbs: ["get", "watch", "list"]
`)

func chartsIstiocorednsTemplatesClusterroleYamlBytes() ([]byte, error) {
	return _chartsIstiocorednsTemplatesClusterroleYaml, nil
}

func chartsIstiocorednsTemplatesClusterroleYaml() (*asset, error) {
	bytes, err := chartsIstiocorednsTemplatesClusterroleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istiocoredns/templates/clusterrole.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstiocorednsTemplatesClusterrolebindingYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-istiocoredns-role-binding-{{ .Release.Namespace }}
  labels:
    app: istiocoredns
    release: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istiocoredns
subjects:
- kind: ServiceAccount
  name: istiocoredns-service-account
  namespace: {{ .Release.Namespace }}
`)

func chartsIstiocorednsTemplatesClusterrolebindingYamlBytes() ([]byte, error) {
	return _chartsIstiocorednsTemplatesClusterrolebindingYaml, nil
}

func chartsIstiocorednsTemplatesClusterrolebindingYaml() (*asset, error) {
	bytes, err := chartsIstiocorednsTemplatesClusterrolebindingYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istiocoredns/templates/clusterrolebinding.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstiocorednsTemplatesConfigmapYaml = []byte(`apiVersion: v1
kind: ConfigMap
metadata:
  name: coredns
  namespace: {{ .Release.Namespace }}
  labels:
    app: istiocoredns
    release: {{ .Release.Name }}
data:
  Corefile: |
    .:53 {
          errors
          health
          {{ if eq -1 (semver  .Values.istiocoredns.coreDNSTag  | (semver "1.4.0").Compare) }}
          # Removed support for the proxy plugin: https://coredns.io/2019/03/03/coredns-1.4.0-release/
          grpc global 127.0.0.1:8053
          forward . /etc/resolv.conf {
            except global
          }
          {{ else }}
          proxy global 127.0.0.1:8053 {
            protocol grpc insecure
          }
          proxy . /etc/resolv.conf
          {{ end }}
          prometheus :9153
          cache 30
          reload
        }
---
`)

func chartsIstiocorednsTemplatesConfigmapYamlBytes() ([]byte, error) {
	return _chartsIstiocorednsTemplatesConfigmapYaml, nil
}

func chartsIstiocorednsTemplatesConfigmapYaml() (*asset, error) {
	bytes, err := chartsIstiocorednsTemplatesConfigmapYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istiocoredns/templates/configmap.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstiocorednsTemplatesDeploymentYaml = []byte(`apiVersion: apps/v1
kind: Deployment
metadata:
  name: istiocoredns
  namespace: {{ .Release.Namespace }}
  labels:
    app: istiocoredns
    release: {{ .Release.Name }}
spec:
  replicas: {{ .Values.istiocoredns.replicaCount }}
  selector:
    matchLabels:
      app: istiocoredns
  strategy:
    rollingUpdate:
      maxSurge: {{ .Values.istiocoredns.rollingMaxSurge }}
      maxUnavailable: {{ .Values.istiocoredns.rollingMaxUnavailable }}
  template:
    metadata:
      name: istiocoredns
      labels:
        app: istiocoredns
        release: {{ .Release.Name }}
      annotations:
        sidecar.istio.io/inject: "false"
        {{- if .Values.istiocoredns.podAnnotations }}
{{ toYaml .Values.istiocoredns.podAnnotations | indent 8 }}
        {{- end }}
    spec:
      serviceAccountName: istiocoredns-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      containers:
      - name: coredns
        image: {{ .Values.istiocoredns.coreDNSImage }}:{{ .Values.istiocoredns.coreDNSTag }}
        imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
        args: [ "-conf", "/etc/coredns/Corefile" ]
        volumeMounts:
        - name: config-volume
          mountPath: /etc/coredns
        ports:
        - containerPort: 53
          name: dns
          protocol: UDP
        - containerPort: 53
          name: dns-tcp
          protocol: TCP
        - containerPort: 9153
          name: metrics
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 60
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 5
        resources:
{{- if .Values.istiocoredns.resources }}
{{ toYaml .Values.istiocoredns.resources | indent 10 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 10 }}
{{- end }}
      - name: istio-coredns-plugin
        command:
        - /usr/local/bin/plugin
        image: {{ .Values.istiocoredns.coreDNSPluginImage }}
        imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
        ports:
        - containerPort: 8053
          name: dns-grpc
          protocol: TCP
        resources:
{{- if .Values.istiocoredns.resources }}
{{ toYaml .Values.istiocorednsresources | indent 10 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 10 }}
{{- end }}
      dnsPolicy: Default
      volumes:
      - name: config-volume
        configMap:
          name: coredns
          items:
          - key: Corefile
            path: Corefile
      affinity:
      {{- include "nodeaffinity" . | indent 6 }}
      {{- include "podAntiAffinity" . | indent 6 }}
{{- if .Values.istiocoredns.tolerations }}
      tolerations:
{{ toYaml .Values.istiocoredns.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}
`)

func chartsIstiocorednsTemplatesDeploymentYamlBytes() ([]byte, error) {
	return _chartsIstiocorednsTemplatesDeploymentYaml, nil
}

func chartsIstiocorednsTemplatesDeploymentYaml() (*asset, error) {
	bytes, err := chartsIstiocorednsTemplatesDeploymentYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istiocoredns/templates/deployment.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstiocorednsTemplatesServiceYaml = []byte(`apiVersion: v1
kind: Service
metadata:
  name: istiocoredns
  namespace: {{ .Release.Namespace }}
  labels:
    app: istiocoredns
    release: {{ .Release.Name }}
spec:
  selector:
    app: istiocoredns
  ports:
  - name: dns
    port: 53
    protocol: UDP
  - name: dns-tcp
    port: 53
    protocol: TCP
`)

func chartsIstiocorednsTemplatesServiceYamlBytes() ([]byte, error) {
	return _chartsIstiocorednsTemplatesServiceYaml, nil
}

func chartsIstiocorednsTemplatesServiceYaml() (*asset, error) {
	bytes, err := chartsIstiocorednsTemplatesServiceYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istiocoredns/templates/service.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstiocorednsTemplatesServiceaccountYaml = []byte(`apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end }}
metadata:
  name: istiocoredns-service-account
  namespace: {{ .Release.Namespace }}
  labels:
    app: istiocoredns
    release: {{ .Release.Name }}
`)

func chartsIstiocorednsTemplatesServiceaccountYamlBytes() ([]byte, error) {
	return _chartsIstiocorednsTemplatesServiceaccountYaml, nil
}

func chartsIstiocorednsTemplatesServiceaccountYaml() (*asset, error) {
	bytes, err := chartsIstiocorednsTemplatesServiceaccountYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istiocoredns/templates/serviceaccount.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsIstiocorednsValuesYaml = []byte(`#
# addon istiocoredns tracing configuration
#
istiocoredns:
  enabled: false
  replicaCount: 1
  rollingMaxSurge: 100%
  rollingMaxUnavailable: 25%
  coreDNSImage: coredns/coredns
  coreDNSTag: 1.6.2
  # Source code for the plugin can be found at
  # https://github.com/istio-ecosystem/istio-coredns-plugin
  # The plugin listens for DNS requests from coredns server at 127.0.0.1:8053
  coreDNSPluginImage: istio/coredns-plugin:0.2-istio-1.1
  nodeSelector: {}
  tolerations: []
  podAnnotations: {}
  resources: {}
  # Specify the pod anti-affinity that allows you to constrain which nodes
  # your pod is eligible to be scheduled based on labels on pods that are
  # already running on the node rather than based on labels on nodes.
  # There are currently two types of anti-affinity:
  #    "requiredDuringSchedulingIgnoredDuringExecution"
  #    "preferredDuringSchedulingIgnoredDuringExecution"
  # which denote "hard" vs. "soft" requirements, you can define your values
  # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
  # correspondingly.
  # For example:
  # podAntiAffinityLabelSelector:
  # - key: security
  #   operator: In
  #   values: S1,S2
  #   topologyKey: "kubernetes.io/hostname"
  # This pod anti-affinity rule says that the pod requires not to be scheduled
  # onto a node if that node is already running a pod with label having key
  # "security" and value "S1".
  podAntiAffinityLabelSelector: []
  podAntiAffinityTermLabelSelector: []
`)

func chartsIstiocorednsValuesYamlBytes() ([]byte, error) {
	return _chartsIstiocorednsValuesYaml, nil
}

func chartsIstiocorednsValuesYaml() (*asset, error) {
	bytes, err := chartsIstiocorednsValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/istiocoredns/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityCitadelChartYaml = []byte(`apiVersion: v1
name: citadel
version: 1.1.0
appVersion: 1.1.0
tillerVersion: ">=2.7.2"
description: Helm chart for istio authentication
keywords:
  - istio
  - security
sources:
  - http://github.com/istio/istio
engine: gotpl
icon: https://istio.io/favicons/android-192x192.png
`)

func chartsSecurityCitadelChartYamlBytes() ([]byte, error) {
	return _chartsSecurityCitadelChartYaml, nil
}

func chartsSecurityCitadelChartYaml() (*asset, error) {
	bytes, err := chartsSecurityCitadelChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/citadel/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityCitadelTemplatesNotesTxt = []byte(`This template contains the 'singleton' part of Istio.

All other components support multiple instances (profiles) running in parallel.

For upgrade purpose, this component should run in istio-system - where the existing mesh certificates are stored.
Will install a new deployment of Citadel, using 1.1 - it can run in parallel with the old-style install of either 1.0
or 1.1.
`)

func chartsSecurityCitadelTemplatesNotesTxtBytes() ([]byte, error) {
	return _chartsSecurityCitadelTemplatesNotesTxt, nil
}

func chartsSecurityCitadelTemplatesNotesTxt() (*asset, error) {
	bytes, err := chartsSecurityCitadelTemplatesNotesTxtBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/citadel/templates/NOTES.txt", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityCitadelTemplates_affinityTpl = []byte(`{{/* affinity - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ */}}

{{- define "nodeaffinity" }}
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityRequiredDuringScheduling" . }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityPreferredDuringScheduling" . }}
{{- end }}

{{- define "nodeAffinityRequiredDuringScheduling" }}
      nodeSelectorTerms:
      - matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
        {{- range $key, $val := .Values.global.arch }}
          {{- if gt ($val | int) 0 }}
          - {{ $key | quote }}
          {{- end }}
        {{- end }}
        {{- $nodeSelector := default .Values.global.defaultNodeSelector .Values.security.nodeSelector -}}
        {{- range $key, $val := $nodeSelector }}
        - key: {{ $key }}
          operator: In
          values:
          - {{ $val | quote }}
        {{- end }}
{{- end }}

{{- define "nodeAffinityPreferredDuringScheduling" }}
  {{- range $key, $val := .Values.global.arch }}
    {{- if gt ($val | int) 0 }}
    - weight: {{ $val | int }}
      preference:
        matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
          - {{ $key | quote }}
    {{- end }}
  {{- end }}
{{- end }}

{{- define "podAntiAffinity" }}
{{- if or .Values.security.podAntiAffinityLabelSelector .Values.security.podAntiAffinityTermLabelSelector}}
  podAntiAffinity:
    {{- if .Values.security.podAntiAffinityLabelSelector }}
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityRequiredDuringScheduling" . }}
    {{- end }}
    {{- if .Values.security.podAntiAffinityTermLabelSelector }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityPreferredDuringScheduling" . }}
    {{- end }}
{{- end }}
{{- end }}

{{- define "podAntiAffinityRequiredDuringScheduling" }}
    {{- range $index, $item := .Values.security.podAntiAffinityLabelSelector }}
    - labelSelector:
        matchExpressions:
        - key: {{ $item.key }}
          operator: {{ $item.operator }}
          {{- if $item.values }}
          values:
          {{- $vals := split "," $item.values }}
          {{- range $i, $v := $vals }}
          - {{ $v | quote }}
          {{- end }}
          {{- end }}
      topologyKey: {{ $item.topologyKey }}
    {{- end }}
{{- end }}

{{- define "podAntiAffinityPreferredDuringScheduling" }}
    {{- range $index, $item := .Values.security.podAntiAffinityTermLabelSelector }}
    - podAffinityTerm:
        labelSelector:
          matchExpressions:
          - key: {{ $item.key }}
            operator: {{ $item.operator }}
            {{- if $item.values }}
            values:
            {{- $vals := split "," $item.values }}
            {{- range $i, $v := $vals }}
            - {{ $v | quote }}
            {{- end }}
            {{- end }}
        topologyKey: {{ $item.topologyKey }}
      weight: 100
    {{- end }}
{{- end }}
`)

func chartsSecurityCitadelTemplates_affinityTplBytes() ([]byte, error) {
	return _chartsSecurityCitadelTemplates_affinityTpl, nil
}

func chartsSecurityCitadelTemplates_affinityTpl() (*asset, error) {
	bytes, err := chartsSecurityCitadelTemplates_affinityTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/citadel/templates/_affinity.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityCitadelTemplates_helpersTpl = []byte(`{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "istio.name" -}}
{{- default .Chart.Name .Values.security.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "istio.fullname" -}}
{{- if .Values.security.fullnameOverride -}}
{{- .Values.security.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.security.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "istio.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a fully qualified configmap name.
*/}}
{{- define "istio.configmap.fullname" -}}
{{- printf "%s-%s" .Release.Name "istio-mesh-config" | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Configmap checksum.
*/}}
{{- define "istio.configmap.checksum" -}}
{{- print $.Template.BasePath "/configmap.yaml" | sha256sum -}}
{{- end -}}
{{/*
Expand the name of the chart.
*/}}
{{- define "security.name" -}}
{{- default .Chart.Name .Values.security.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "security.fullname" -}}
{{- if .Values.security.fullnameOverride -}}
{{- .Values.security.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.security.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "security.chart" -}}
{{- .Chart.Name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
`)

func chartsSecurityCitadelTemplates_helpersTplBytes() ([]byte, error) {
	return _chartsSecurityCitadelTemplates_helpersTpl, nil
}

func chartsSecurityCitadelTemplates_helpersTpl() (*asset, error) {
	bytes, err := chartsSecurityCitadelTemplates_helpersTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/citadel/templates/_helpers.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityCitadelTemplatesClusterroleYaml = []byte(`{{ if .Values.clusterResources }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-citadel-{{ .Release.Namespace }}
  labels:
    app: citadel
    release: {{ .Release.Name }}
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["create", "get", "update"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["create", "get", "watch", "list", "update", "delete"]
- apiGroups: [""]
  resources: ["serviceaccounts", "services", "namespaces"]
  verbs: ["get", "watch", "list"]
- apiGroups: ["authentication.k8s.io"]
  resources: ["tokenreviews"]
  verbs: ["create"]

---
{{ end }}
`)

func chartsSecurityCitadelTemplatesClusterroleYamlBytes() ([]byte, error) {
	return _chartsSecurityCitadelTemplatesClusterroleYaml, nil
}

func chartsSecurityCitadelTemplatesClusterroleYaml() (*asset, error) {
	bytes, err := chartsSecurityCitadelTemplatesClusterroleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/citadel/templates/clusterrole.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityCitadelTemplatesClusterrolebindingYaml = []byte(`{{ if .Values.clusterResources }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-citadel-{{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istio-citadel-{{ .Release.Namespace }}
subjects:
  - kind: ServiceAccount
    name: istio-citadel-service-account
    namespace: {{ .Release.Namespace }}
---
{{- end}}
`)

func chartsSecurityCitadelTemplatesClusterrolebindingYamlBytes() ([]byte, error) {
	return _chartsSecurityCitadelTemplatesClusterrolebindingYaml, nil
}

func chartsSecurityCitadelTemplatesClusterrolebindingYaml() (*asset, error) {
	bytes, err := chartsSecurityCitadelTemplatesClusterrolebindingYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/citadel/templates/clusterrolebinding.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityCitadelTemplatesDeploymentYaml = []byte(`# istio CA watching all namespaces
apiVersion: apps/v1
kind: Deployment
metadata:
  name: istio-citadel
  namespace: {{ .Release.Namespace }}
  labels:
    app: security
    istio: citadel
    release: {{ .Release.Name }}

spec:
  selector:
    matchLabels:
      istio: citadel
  replicas: {{ .Values.security.replicaCount }}
  strategy:
    rollingUpdate:
      maxSurge: {{ .Values.security.rollingMaxSurge }}
      maxUnavailable: {{ .Values.security.rollingMaxUnavailable }}
  template:
    metadata:
      labels:
        app: citadel
        istio: citadel
      annotations:
        sidecar.istio.io/inject: "false"
        {{- if .Values.security.podAnnotations }}
{{ toYaml .Values.security.podAnnotations | indent 8 }}
        {{- end }}
    spec:
      serviceAccountName: istio-citadel-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      containers:
        - name: citadel
          image: "{{ .Values.global.hub }}/{{ .Values.security.image }}:{{ .Values.global.tag }}"
          imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
          args:
            {{- if .Values.global.sds.enabled }}
            - --sds-enabled=true
            {{- end }}
            - --append-dns-names=true
            - --grpc-port=8060
            - --citadel-storage-namespace={{ .Release.Namespace }}
          {{- if .Values.kustomize }}
            - --custom-dns-names=$(CITADEL_DNS)
          {{- else }}
            - --custom-dns-names={{ range $k,$v := .Values.security.dnsCerts }}{{ $k }}:{{ $v }},{{ end }}
          {{- end }}
          {{- if .Values.security.selfSigned }}
            - --self-signed-ca=true
          {{- else }}
            - --self-signed-ca=false
            - --signing-cert=/etc/cacerts/ca-cert.pem
            - --signing-key=/etc/cacerts/ca-key.pem
            - --root-cert=/etc/cacerts/root-cert.pem
            - --cert-chain=/etc/cacerts/cert-chain.pem
          {{- end }}
          {{- if .Values.global.trustDomain }}
            - --trust-domain={{ .Values.global.trustDomain }}
          {{- end }}
          {{- if .Values.security.workloadCertTtl }}
            - --workload-cert-ttl={{ .Values.security.workloadCertTtl }}
          {{- end }}
          {{- if .Values.security.citadelHealthCheck }}
            - --liveness-probe-path=/tmp/ca.liveness # path to the liveness health check status file
            - --liveness-probe-interval=60s # interval for health check file update
            - --probe-check-interval=15s    # interval for health status check
          {{- end }}
          {{- if .Values.global.logAsJson }}
            - --log_as_json
          {{- end }}
          env:
          - name: CITADEL_ENABLE_NAMESPACES_BY_DEFAULT
            value: "{{ .Values.security.enableNamespacesByDefault }}"
          {{- if .Values.security.env }}
          {{- range $key, $val := .Values.security.env }}
          - name: {{ $key }}
            value: {{ $val | quote }}
          {{- end }}
          {{- end }}
          livenessProbe:
          {{- if .Values.security.citadelHealthCheck }}
            exec:
              command:
              - /usr/local/bin/istio_ca
              - probe
              - --probe-path=/tmp/ca.liveness # path to the liveness health check status file
              - --interval=125s # the maximum time gap allowed between the file mtime and the current sys clock
            initialDelaySeconds: 60
            periodSeconds: 60
          {{- else }}
            httpGet:
              path: /version
              port: 15014
            initialDelaySeconds: 5
            periodSeconds: 5
          {{- end }}
          resources:
{{- if .Values.security.resources }}
{{ toYaml .Values.security.resources | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 12 }}
{{- end }}
          securityContext:
            runAsUser: 1337
            runAsGroup: 1337
            runAsNonRoot: true
            capabilities:
              drop:
              - ALL
{{- if not .Values.security.selfSigned }}
          volumeMounts:
          - name: cacerts
            mountPath: /etc/cacerts
            readOnly: true
      securityContext:
        fsGroup: 1337
      volumes:
      - name: cacerts
        secret:
         secretName: cacerts
         optional: true
{{- end }}
      affinity:
      {{- include "nodeaffinity" . | indent 6 }}
      {{- include "podAntiAffinity" . | indent 6 }}
{{- if .Values.security.tolerations }}
      tolerations:
{{ toYaml .Values.security.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}
`)

func chartsSecurityCitadelTemplatesDeploymentYamlBytes() ([]byte, error) {
	return _chartsSecurityCitadelTemplatesDeploymentYaml, nil
}

func chartsSecurityCitadelTemplatesDeploymentYaml() (*asset, error) {
	bytes, err := chartsSecurityCitadelTemplatesDeploymentYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/citadel/templates/deployment.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityCitadelTemplatesPoddisruptionbudgetYaml = []byte(`{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: istio-citadel
  namespace: {{ .Release.Namespace }}
  labels:
    app: security
    istio: citadel
    release: {{ .Release.Name }}
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app: citadel
      istio: citadel
{{- end }}
`)

func chartsSecurityCitadelTemplatesPoddisruptionbudgetYamlBytes() ([]byte, error) {
	return _chartsSecurityCitadelTemplatesPoddisruptionbudgetYaml, nil
}

func chartsSecurityCitadelTemplatesPoddisruptionbudgetYaml() (*asset, error) {
	bytes, err := chartsSecurityCitadelTemplatesPoddisruptionbudgetYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/citadel/templates/poddisruptionbudget.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityCitadelTemplatesServiceYaml = []byte(`apiVersion: v1
kind: Service
metadata:
  # Must match the certificate, this is used in the node agent in same namespace.
  name: istio-citadel
  namespace: {{ .Release.Namespace }}
  labels:
    app: security
    istio: citadel
    release: {{ .Release.Name }}

spec:
  ports:
    - name: grpc-citadel
      port: 8060
      targetPort: 8060
      protocol: TCP
    - name: http-monitoring
      port: 15014
  selector:
    app: citadel
`)

func chartsSecurityCitadelTemplatesServiceYamlBytes() ([]byte, error) {
	return _chartsSecurityCitadelTemplatesServiceYaml, nil
}

func chartsSecurityCitadelTemplatesServiceYaml() (*asset, error) {
	bytes, err := chartsSecurityCitadelTemplatesServiceYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/citadel/templates/service.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityCitadelTemplatesServiceaccountYaml = []byte(`apiVersion: v1
kind: ServiceAccount
metadata:
  name: istio-citadel-service-account
  namespace: {{ .Release.Namespace }}
  labels:
    app: security
    release: {{ .Release.Name }}
  {{- if .Values.global.imagePullSecrets }}
spec:
  imagePullSecrets:
  {{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
  {{- end }}
  {{- end }}
`)

func chartsSecurityCitadelTemplatesServiceaccountYamlBytes() ([]byte, error) {
	return _chartsSecurityCitadelTemplatesServiceaccountYaml, nil
}

func chartsSecurityCitadelTemplatesServiceaccountYaml() (*asset, error) {
	bytes, err := chartsSecurityCitadelTemplatesServiceaccountYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/citadel/templates/serviceaccount.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityCitadelValuesYaml = []byte(`#
# security (citadel) configuration
#
security:
  enabled: true
  replicaCount: 1
  rollingMaxSurge: 100%
  rollingMaxUnavailable: 25%
  image: citadel
  selfSigned: true # indicate if self-signed CA is used.
  citadelHealthCheck: false

  # 90*24hour = 2160h
  workloadCertTtl: 2160h

  # Environment variables that configure Citadel.
  env: {}

  # Determines Citadel default behavior if the ca.istio.io/env or ca.istio.io/override
  # labels are not found on a given namespace.
  #
  # For example: consider a namespace called "target", which has neither the "ca.istio.io/env"
  # nor the "ca.istio.io/override" namespace labels. To decide whether or not to generate secrets
  # for service accounts created in this "target" namespace, Citadel will defer to this option. If the value
  # of this option is "true" in this case, secrets will be generated for the "target" namespace.
  # If the value of this option is "false" Citadel will not generate secrets upon service account creation.
  enableNamespacesByDefault: true

  # Galley, pilot in each 'profile' must have a DNS cert.
  dnsCerts:
    istio-pilot-service-account.istio-control: istio-pilot.istio-control
    istio-pilot-service-account.istio-pilot11: istio-pilot.istio-system

    istio-sidecar-injector-service-account.istio-remote: istio-sidecar-injector.istio-remote.svc
    istio-sidecar-injector-service-account.istio-pilot11: istio-sidecar-injector.istio-pilot11.svc
    istio-sidecar-injector-service-account.istio-control: istio-sidecar-injector.istio-control.svc
    istio-sidecar-injector-service-account.istio-master: istio-sidecar-injector.istio-master.svc
    istio-sidecar-injector-service-account.istio-control-master: istio-sidecar-injector.istio-control-master.svc

    istio-galley-service-account.istio-pilot11: istio-galley.istio-pilot11.svc
    istio-galley-service-account.istio-control: istio-galley.istio-control.svc

    istio-galley-service-account.istio-master: istio-galley.istio-master.svc
    istio-galley-service-account.istio-control-master: istio-galley.istio-control-master.svc

    istio-galley-service-account.istio-config: istio-galley.istio-config.svc

  nodeSelector: {}
  tolerations: []
  podAnnotations: {}

  # Specify the pod anti-affinity that allows you to constrain which nodes
  # your pod is eligible to be scheduled based on labels on pods that are
  # already running on the node rather than based on labels on nodes.
  # There are currently two types of anti-affinity:
  #    "requiredDuringSchedulingIgnoredDuringExecution"
  #    "preferredDuringSchedulingIgnoredDuringExecution"
  # which denote "hard" vs. "soft" requirements, you can define your values
  # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
  # correspondingly.
  # For example:
  # podAntiAffinityLabelSelector:
  # - key: security
  #   operator: In
  #   values: S1,S2
  #   topologyKey: "kubernetes.io/hostname"
  # This pod anti-affinity rule says that the pod requires not to be scheduled
  # onto a node if that node is already running a pod with label having key
  # "security" and value "S1".
  podAntiAffinityLabelSelector: []
  podAntiAffinityTermLabelSelector: []

  resources: {}
kustomize: false
`)

func chartsSecurityCitadelValuesYamlBytes() ([]byte, error) {
	return _chartsSecurityCitadelValuesYaml, nil
}

func chartsSecurityCitadelValuesYaml() (*asset, error) {
	bytes, err := chartsSecurityCitadelValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/citadel/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityNodeagentChartYaml = []byte(`apiVersion: v1
name: nodeagent
version: 1.1.0
appVersion: 1.1.0
tillerVersion: ">=2.7.2"
description: Helm chart for nodeagent deployment
keywords:
  - istio
  - nodeagent
sources:
  - http://github.com/istio/istio
engine: gotpl
icon: https://istio.io/favicons/android-192x192.png
`)

func chartsSecurityNodeagentChartYamlBytes() ([]byte, error) {
	return _chartsSecurityNodeagentChartYaml, nil
}

func chartsSecurityNodeagentChartYaml() (*asset, error) {
	bytes, err := chartsSecurityNodeagentChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/nodeagent/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityNodeagentTemplates_affinityTpl = []byte(`{{/* affinity - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ */}}

{{- define "nodeaffinity" }}
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityRequiredDuringScheduling" . }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "nodeAffinityPreferredDuringScheduling" . }}
{{- end }}

{{- define "nodeAffinityRequiredDuringScheduling" }}
      nodeSelectorTerms:
      - matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
        {{- range $key, $val := .Values.global.arch }}
          {{- if gt ($val | int) 0 }}
          - {{ $key | quote }}
          {{- end }}
        {{- end }}
        {{- $nodeSelector := default .Values.global.defaultNodeSelector .Values.nodeagent.nodeSelector -}}
        {{- range $key, $val := $nodeSelector }}
        - key: {{ $key }}
          operator: In
          values:
          - {{ $val | quote }}
        {{- end }}
{{- end }}

{{- define "nodeAffinityPreferredDuringScheduling" }}
  {{- range $key, $val := .Values.global.arch }}
    {{- if gt ($val | int) 0 }}
    - weight: {{ $val | int }}
      preference:
        matchExpressions:
        - key: beta.kubernetes.io/arch
          operator: In
          values:
          - {{ $key | quote }}
    {{- end }}
  {{- end }}
{{- end }}

{{- define "podAntiAffinity" }}
{{- if or .Values.nodeagent.podAntiAffinityLabelSelector .Values.nodeagent.podAntiAffinityTermLabelSelector}}
  podAntiAffinity:
    {{- if .Values.nodeagent.podAntiAffinityLabelSelector }}
    requiredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityRequiredDuringScheduling" . }}
    {{- end }}
    {{- if .Values.nodeagent.podAntiAffinityTermLabelSelector }}
    preferredDuringSchedulingIgnoredDuringExecution:
    {{- include "podAntiAffinityPreferredDuringScheduling" . }}
    {{- end }}
{{- end }}
{{- end }}

{{- define "podAntiAffinityRequiredDuringScheduling" }}
    {{- range $index, $item := .Values.nodeagent.podAntiAffinityLabelSelector }}
    - labelSelector:
        matchExpressions:
        - key: {{ $item.key }}
          operator: {{ $item.operator }}
          {{- if $item.values }}
          values:
          {{- $vals := split "," $item.values }}
          {{- range $i, $v := $vals }}
          - {{ $v | quote }}
          {{- end }}
          {{- end }}
      topologyKey: {{ $item.topologyKey }}
    {{- end }}
{{- end }}

{{- define "podAntiAffinityPreferredDuringScheduling" }}
    {{- range $index, $item := .Values.nodeagent.podAntiAffinityTermLabelSelector }}
    - podAffinityTerm:
        labelSelector:
          matchExpressions:
          - key: {{ $item.key }}
            operator: {{ $item.operator }}
            {{- if $item.values }}
            values:
            {{- $vals := split "," $item.values }}
            {{- range $i, $v := $vals }}
            - {{ $v | quote }}
            {{- end }}
            {{- end }}
        topologyKey: {{ $item.topologyKey }}
      weight: 100
    {{- end }}
{{- end }}
`)

func chartsSecurityNodeagentTemplates_affinityTplBytes() ([]byte, error) {
	return _chartsSecurityNodeagentTemplates_affinityTpl, nil
}

func chartsSecurityNodeagentTemplates_affinityTpl() (*asset, error) {
	bytes, err := chartsSecurityNodeagentTemplates_affinityTplBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/nodeagent/templates/_affinity.tpl", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityNodeagentTemplatesClusterroleYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-nodeagent-{{ .Release.Namespace }}
  labels:
    app: istio-nodeagent
    release: {{ .Release.Name }}
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get"]
`)

func chartsSecurityNodeagentTemplatesClusterroleYamlBytes() ([]byte, error) {
	return _chartsSecurityNodeagentTemplatesClusterroleYaml, nil
}

func chartsSecurityNodeagentTemplatesClusterroleYaml() (*asset, error) {
	bytes, err := chartsSecurityNodeagentTemplatesClusterroleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/nodeagent/templates/clusterrole.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityNodeagentTemplatesClusterrolebindingYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-nodeagent-{{ .Release.Namespace }}
  labels:
    app: istio-nodeagent
    release: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istio-nodeagent-{{ .Release.Namespace }}
subjects:
  - kind: ServiceAccount
    name: istio-nodeagent-service-account
    namespace: {{ .Release.Namespace }}
`)

func chartsSecurityNodeagentTemplatesClusterrolebindingYamlBytes() ([]byte, error) {
	return _chartsSecurityNodeagentTemplatesClusterrolebindingYaml, nil
}

func chartsSecurityNodeagentTemplatesClusterrolebindingYaml() (*asset, error) {
	bytes, err := chartsSecurityNodeagentTemplatesClusterrolebindingYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/nodeagent/templates/clusterrolebinding.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityNodeagentTemplatesDaemonsetYaml = []byte(`apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: istio-nodeagent
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-nodeagent
    istio: nodeagent
    release: {{ .Release.Name }}
spec:
  selector:
    matchLabels:
      istio: nodeagent
  template:
    metadata:
      labels:
        app: istio-nodeagent
        istio: nodeagent
        release: {{ .Release.Name }}
      annotations:
        sidecar.istio.io/inject: "false"
        {{- if .Values.nodeagent.podAnnotations }}
{{ toYaml .Values.nodeagent.podAnnotations | indent 8 }}
        {{- end }}
    spec:
      serviceAccountName: istio-nodeagent-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      containers:
        - name: nodeagent
{{- if contains "/" .Values.nodeagent.image }}
          image: "{{ .Values.nodeagent.image }}"
{{- else }}
          image: "{{ .Values.nodeagent.hub | default .Values.global.hub }}/{{ .Values.nodeagent.image }}:{{ .Values.nodeagent.tag | default .Values.global.tag }}"
{{- end }}
          imagePullPolicy: {{ .Values.global.imagePullPolicy | default "Always" }}
          args:
          {{- if .Values.global.logAsJson }}
            - --log_as_json
          {{- end }}
          volumeMounts:
            - mountPath: /var/run/sds
              name: sdsudspath
          env:
          {{- if .Values.nodeagent.env }}
          {{- range $key, $val := .Values.nodeagent.env }}
            - name: {{ $key }}
              value: "{{ $val }}"
          {{- end }}
          {{- end }}
            - name: "TRUST_DOMAIN"
              value: "{{ .Values.global.trustDomain }}"
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
      volumes:
        - name: sdsudspath
          hostPath:
            path: /var/run/sds
      affinity:
      {{- include "nodeaffinity" . | indent 6 }}
      {{- include "podAntiAffinity" . | indent 6 }}
{{- if .Values.nodeagent.tolerations }}
      tolerations:
{{ toYaml .Values.nodeagent.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}
  updateStrategy:
    type: RollingUpdate
`)

func chartsSecurityNodeagentTemplatesDaemonsetYamlBytes() ([]byte, error) {
	return _chartsSecurityNodeagentTemplatesDaemonsetYaml, nil
}

func chartsSecurityNodeagentTemplatesDaemonsetYaml() (*asset, error) {
	bytes, err := chartsSecurityNodeagentTemplatesDaemonsetYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/nodeagent/templates/daemonset.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityNodeagentTemplatesServiceaccountYaml = []byte(`apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end }}
metadata:
  name: istio-nodeagent-service-account
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-nodeagent
    release: {{ .Release.Name }}
`)

func chartsSecurityNodeagentTemplatesServiceaccountYamlBytes() ([]byte, error) {
	return _chartsSecurityNodeagentTemplatesServiceaccountYaml, nil
}

func chartsSecurityNodeagentTemplatesServiceaccountYaml() (*asset, error) {
	bytes, err := chartsSecurityNodeagentTemplatesServiceaccountYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/nodeagent/templates/serviceaccount.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _chartsSecurityNodeagentValuesYaml = []byte(`#
# nodeagent configuration
#
nodeagent:
  enabled: false
  hub: ""
  tag: ""
  image: node-agent-k8s
  env:
    # name of authentication provider.
    CA_PROVIDER: ""
    # CA endpoint.
    CA_ADDR: ""  
    # names of authentication provider's plugins.
    PLUGINS: ""

  nodeSelector: {}
  tolerations: []
  podAnnotations: {}

  # Specify the pod anti-affinity that allows you to constrain which nodes
  # your pod is eligible to be scheduled based on labels on pods that are
  # already running on the node rather than based on labels on nodes.
  # There are currently two types of anti-affinity:
  #    "requiredDuringSchedulingIgnoredDuringExecution"
  #    "preferredDuringSchedulingIgnoredDuringExecution"
  # which denote "hard" vs. "soft" requirements, you can define your values
  # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
  # correspondingly.
  # For example:
  # podAntiAffinityLabelSelector:
  # - key: security
  #   operator: In
  #   values: S1,S2
  #   topologyKey: "kubernetes.io/hostname"
  # This pod anti-affinity rule says that the pod requires not to be scheduled
  # onto a node if that node is already running a pod with label having key
  # "security" and value "S1".
  podAntiAffinityLabelSelector: []
  podAntiAffinityTermLabelSelector: []
`)

func chartsSecurityNodeagentValuesYamlBytes() ([]byte, error) {
	return _chartsSecurityNodeagentValuesYaml, nil
}

func chartsSecurityNodeagentValuesYaml() (*asset, error) {
	bytes, err := chartsSecurityNodeagentValuesYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "charts/security/nodeagent/values.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _examplesCustomresourceIstio_v1alpha1_istiooperator_crYaml = []byte(`---
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: example-istiocontrolplane
spec:
  profile: demo
...
`)

func examplesCustomresourceIstio_v1alpha1_istiooperator_crYamlBytes() ([]byte, error) {
	return _examplesCustomresourceIstio_v1alpha1_istiooperator_crYaml, nil
}

func examplesCustomresourceIstio_v1alpha1_istiooperator_crYaml() (*asset, error) {
	bytes, err := examplesCustomresourceIstio_v1alpha1_istiooperator_crYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "examples/customresource/istio_v1alpha1_istiooperator_cr.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _examplesGooglecaValuesIstioGoogleCaYaml = []byte(`apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  security:
    components:
      nodeAgent:
        enabled: true
  values:
    global:
      controlPlaneSecurityEnabled: true
      mtls:
        enabled: true
      sds:
        enabled: true
        udsPath: "unix:/var/run/sds/uds_path"
        token:
          aud: "istio-ca"
      useMCP: true
    nodeagent:
      image: node-agent-k8s
      env:
        CA_PROVIDER: "GoogleCA"
        CA_ADDR: "meshca.googleapis.com:443"
        PLUGINS: "GoogleTokenExchange"
        GKE_CLUSTER_URL: ""
`)

func examplesGooglecaValuesIstioGoogleCaYamlBytes() ([]byte, error) {
	return _examplesGooglecaValuesIstioGoogleCaYaml, nil
}

func examplesGooglecaValuesIstioGoogleCaYaml() (*asset, error) {
	bytes, err := examplesGooglecaValuesIstioGoogleCaYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "examples/googleca/values-istio-google-ca.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _examplesMulticlusterValuesIstioMulticlusterGatewaysYaml = []byte(`apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  addonComponents:
    istiocoredns:
      enabled: true

  components:
    egressGateways:
      - name: istio-egressgateway
        enabled: true

  values:
    global:
      # Provides dns resolution for global services
      podDNSSearchNamespaces:
        - global
        - "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"

      multiCluster:
        enabled: true

      controlPlaneSecurityEnabled: true

    # Multicluster with gateways requires a root CA
    # Cluster local CAs are bootstrapped with the root CA.
    security:
      selfSigned: false

    gateways:
      istio-egressgateway:
        env:
          # Needed to route traffic via egress gateway if desired.
          ISTIO_META_REQUESTED_NETWORK_VIEW: "external"
`)

func examplesMulticlusterValuesIstioMulticlusterGatewaysYamlBytes() ([]byte, error) {
	return _examplesMulticlusterValuesIstioMulticlusterGatewaysYaml, nil
}

func examplesMulticlusterValuesIstioMulticlusterGatewaysYaml() (*asset, error) {
	bytes, err := examplesMulticlusterValuesIstioMulticlusterGatewaysYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "examples/multicluster/values-istio-multicluster-gateways.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _examplesMulticlusterValuesIstioMulticlusterPrimaryYaml = []byte(`apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  values:
    security:
      selfSigned: false
    gateways:
      istio-ingressgateway:
        env:
          ISTIO_META_NETWORK: "network1"
    global:
      mtls:
        enabled: true
      controlPlaneSecurityEnabled: true
      proxy:
        accessLogFile: "/dev/stdout"
      network: network1
      meshExpansion:
        enabled: true
    pilot:
      meshNetworks:
        networks:
          network1:
            endpoints:
            - fromRegistry: Kubernetes
            gateways:
            - address: 0.0.0.0
              port: 443
          network2:
            endpoints:
            - fromRegistry: n2-k8s-config
            gateways:
            - address: 0.0.0.0
              port: 443
`)

func examplesMulticlusterValuesIstioMulticlusterPrimaryYamlBytes() ([]byte, error) {
	return _examplesMulticlusterValuesIstioMulticlusterPrimaryYaml, nil
}

func examplesMulticlusterValuesIstioMulticlusterPrimaryYaml() (*asset, error) {
	bytes, err := examplesMulticlusterValuesIstioMulticlusterPrimaryYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "examples/multicluster/values-istio-multicluster-primary.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _examplesUserGatewayIngressGatewayOnlyYaml = []byte(`apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: empty
  gateways:
    enabled: true
    components:
      namespace: my-namespace
      ingressGateway:
        enabled: true
`)

func examplesUserGatewayIngressGatewayOnlyYamlBytes() ([]byte, error) {
	return _examplesUserGatewayIngressGatewayOnlyYaml, nil
}

func examplesUserGatewayIngressGatewayOnlyYaml() (*asset, error) {
	bytes, err := examplesUserGatewayIngressGatewayOnlyYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "examples/user-gateway/ingress-gateway-only.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _examplesVmValuesIstioMeshexpansionGatewaysYaml = []byte(`apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  values:
    global:
      multiCluster:
        enabled: true

      meshExpansion:
        enabled: true

      controlPlaneSecurityEnabled: true

    # Multicluster with gateways requires a root CA
    # Cluster local CAs are bootstrapped with the root CA.
    security:
      selfSigned: false

    # Provides dns resolution for service entries of form
    # name.namespace.global
    istiocoredns:
      enabled: true
`)

func examplesVmValuesIstioMeshexpansionGatewaysYamlBytes() ([]byte, error) {
	return _examplesVmValuesIstioMeshexpansionGatewaysYaml, nil
}

func examplesVmValuesIstioMeshexpansionGatewaysYaml() (*asset, error) {
	bytes, err := examplesVmValuesIstioMeshexpansionGatewaysYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "examples/vm/values-istio-meshexpansion-gateways.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _examplesVmValuesIstioMeshexpansionYaml = []byte(`apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  values:
    global:
      meshExpansion:
        enabled: true

      controlPlaneSecurityEnabled: true

    # Multicluster with gateways requires a root CA
    # Cluster local CAs are bootstrapped with the root CA.
    security:
      selfSigned: false
`)

func examplesVmValuesIstioMeshexpansionYamlBytes() ([]byte, error) {
	return _examplesVmValuesIstioMeshexpansionYaml, nil
}

func examplesVmValuesIstioMeshexpansionYaml() (*asset, error) {
	bytes, err := examplesVmValuesIstioMeshexpansionYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "examples/vm/values-istio-meshexpansion.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _operatorChartChartYaml = []byte(`apiVersion: v1
name: operator
version: 1.5.0
tillerVersion: ">=2.7.2"
description: Helm chart for deploying Istio operator
keywords:
  - istio
  - operator
sources:
  - http://github.com/istio/operator
engine: gotpl
icon: https://istio.io/favicons/android-192x192.png
`)

func operatorChartChartYamlBytes() ([]byte, error) {
	return _operatorChartChartYaml, nil
}

func operatorChartChartYaml() (*asset, error) {
	bytes, err := operatorChartChartYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "operator-chart/Chart.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _operatorChartTemplatesClusterroleYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: null
  name: istio-operator
rules:
# istio groups
- apiGroups:
  - authentication.istio.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - config.istio.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - install.istio.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - networking.istio.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - rbac.istio.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - security.istio.io
  resources:
  - '*'
  verbs:
  - '*'
# k8s groups
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - mutatingwebhookconfigurations
  - validatingwebhookconfigurations
  verbs:
  - '*'
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions.apiextensions.k8s.io
  - customresourcedefinitions
  verbs:
  - '*'
- apiGroups:
  - apps
  - extensions
  resources:
  - daemonsets
  - deployments
  - deployments/finalizers
  - ingresses
  - replicasets
  - statefulsets
  verbs:
  - '*'
- apiGroups:
  - autoscaling
  resources:
  - horizontalpodautoscalers
  verbs:
  - '*'
- apiGroups:
  - monitoring.coreos.com
  resources:
  - servicemonitors
  verbs:
  - get
  - create
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  verbs:
  - '*'
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterrolebindings
  - clusterroles
  - roles
  - rolebindings
  verbs:
  - '*'
- apiGroups:
  - ""
  resources:
  - configmaps
  - endpoints
  - events
  - namespaces
  - pods
  - persistentvolumeclaims
  - secrets
  - services
  - serviceaccounts
  verbs:
  - '*'
---
`)

func operatorChartTemplatesClusterroleYamlBytes() ([]byte, error) {
	return _operatorChartTemplatesClusterroleYaml, nil
}

func operatorChartTemplatesClusterroleYaml() (*asset, error) {
	bytes, err := operatorChartTemplatesClusterroleYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "operator-chart/templates/clusterrole.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _operatorChartTemplatesClusterrole_bindingYaml = []byte(`kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: istio-operator
subjects:
- kind: ServiceAccount
  name: istio-operator
  namespace: {{.Values.operatorNamespace}}
roleRef:
  kind: ClusterRole
  name: istio-operator
  apiGroup: rbac.authorization.k8s.io
---
`)

func operatorChartTemplatesClusterrole_bindingYamlBytes() ([]byte, error) {
	return _operatorChartTemplatesClusterrole_bindingYaml, nil
}

func operatorChartTemplatesClusterrole_bindingYaml() (*asset, error) {
	bytes, err := operatorChartTemplatesClusterrole_bindingYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "operator-chart/templates/clusterrole_binding.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _operatorChartTemplatesCrdYaml = []byte(`apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: istiooperators.install.istio.io
spec:
  group: install.istio.io
  names:
    kind: IstioOperator
    plural: istiooperators
    singular: istiooperator
    shortNames:
    - iop
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      properties:
        apiVersion:
          description: 'APIVersion defines the versioned schema of this representation
            of an object. Servers should convert recognized schemas to the latest
            internal value, and may reject unrecognized values.
            More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#resources'
          type: string
        kind:
          description: 'Kind is a string value representing the REST resource this
            object represents. Servers may infer this from the endpoint the client
            submits requests to. Cannot be updated. In CamelCase.
            More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
          type: string
        spec:
          description: 'Specification of the desired state of the istio control plane resource.
            More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status'
          type: object
        status:
          description: 'Status describes each of istio control plane component status at the current time.
            0 means NONE, 1 means UPDATING, 2 means HEALTHY, 3 means ERROR, 4 means RECONCILING.
            More info: https://github.com/istio/operator/blob/master/pkg/apis/istio/v1alpha2/v1alpha2.pb.html &
            https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status'
          type: object
  versions:
  - name: v1alpha1
    served: true
    storage: true
---
`)

func operatorChartTemplatesCrdYamlBytes() ([]byte, error) {
	return _operatorChartTemplatesCrdYaml, nil
}

func operatorChartTemplatesCrdYaml() (*asset, error) {
	bytes, err := operatorChartTemplatesCrdYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "operator-chart/templates/crd.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _operatorChartTemplatesDeploymentYaml = []byte(`apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: {{.Values.operatorNamespace}}
  name: istio-operator
spec:
  replicas: 1
  selector:
    matchLabels:
      name: istio-operator
  template:
    metadata:
      labels:
        name: istio-operator
    spec:
      serviceAccountName: istio-operator
      containers:
        - name: istio-operator
          image: {{.Values.hub}}/operator:{{.Values.tag}}
          command:
          - operator
          - server
          imagePullPolicy: IfNotPresent
          resources:
            limits:
              cpu: 200m
              memory: 256Mi
            requests:
              cpu: 50m
              memory: 128Mi
          env:
            - name: WATCH_NAMESPACE
              value: {{.Values.istioNamespace}}
            - name: LEADER_ELECTION_NAMESPACE
              value: {{.Values.operatorNamespace}}
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPERATOR_NAME
              value: {{.Values.operatorNamespace}}
---
`)

func operatorChartTemplatesDeploymentYamlBytes() ([]byte, error) {
	return _operatorChartTemplatesDeploymentYaml, nil
}

func operatorChartTemplatesDeploymentYaml() (*asset, error) {
	bytes, err := operatorChartTemplatesDeploymentYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "operator-chart/templates/deployment.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _operatorChartTemplatesNamespaceYaml = []byte(`apiVersion: v1
kind: Namespace
metadata:
  name: istio-operator
  labels:
    istio-operator-managed: Reconcile
    istio-injection: disabled
---
`)

func operatorChartTemplatesNamespaceYamlBytes() ([]byte, error) {
	return _operatorChartTemplatesNamespaceYaml, nil
}

func operatorChartTemplatesNamespaceYaml() (*asset, error) {
	bytes, err := operatorChartTemplatesNamespaceYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "operator-chart/templates/namespace.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _operatorChartTemplatesServiceYaml = []byte(`apiVersion: v1
kind: Service
metadata:
  namespace: {{.Values.operatorNamespace}}
  labels:
    name: istio-operator
  name: istio-operator
spec:
  ports:
  - name: http-metrics
    port: 8383
    targetPort: 8383
  selector:
    name: istio-operator
---
`)

func operatorChartTemplatesServiceYamlBytes() ([]byte, error) {
	return _operatorChartTemplatesServiceYaml, nil
}

func operatorChartTemplatesServiceYaml() (*asset, error) {
	bytes, err := operatorChartTemplatesServiceYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "operator-chart/templates/service.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _operatorChartTemplatesService_accountYaml = []byte(`apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: {{.Values.operatorNamespace}}
  name: istio-operator
---
`)

func operatorChartTemplatesService_accountYamlBytes() ([]byte, error) {
	return _operatorChartTemplatesService_accountYaml, nil
}

func operatorChartTemplatesService_accountYaml() (*asset, error) {
	bytes, err := operatorChartTemplatesService_accountYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "operator-chart/templates/service_account.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _profilesDefaultYaml = []byte(`apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
spec:
  hub: gcr.io/istio-testing
  tag: latest

  # Traffic management feature
  components:
    base:
      enabled: true
    pilot:
      enabled: true
      k8s:
        env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
          timeoutSeconds: 5
        resources:
          requests:
            cpu: 500m
            memory: 2048Mi
        strategy:
          rollingUpdate:
            maxSurge: "100%"
            maxUnavailable: "25%"

  # Policy feature
    policy:
      enabled: false
      k8s:
        hpaSpec:
          maxReplicas: 5
          minReplicas: 1
          scaleTargetRef:
            apiVersion: apps/v1
            kind: Deployment
            name: istio-policy
          metrics:
            - type: Resource
              resource:
                name: cpu
                targetAverageUtilization: 80
        env:
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
        strategy:
          rollingUpdate:
            maxSurge: "100%"
            maxUnavailable: "25%"

   # Telemetry feature
    telemetry:
      enabled: false
      k8s:
        env:
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: GOMAXPROCS
            value: "6"
        hpaSpec:
          maxReplicas: 5
          minReplicas: 1
          scaleTargetRef:
            apiVersion: apps/v1
            kind: Deployment
            name: istio-telemetry
          metrics:
            - type: Resource
              resource:
                name: cpu
                targetAverageUtilization: 80
        replicaCount: 1
        resources:
          requests:
            cpu: 1000m
            memory: 1G
          limits:
            cpu: 4800m
            memory: 4G
        strategy:
          rollingUpdate:
            maxSurge: "100%"
            maxUnavailable: "25%"

  # Security feature
    citadel:
      enabled: false
      k8s:
        strategy:
          rollingUpdate:
            maxSurge: "100%"
            maxUnavailable: "25%"

    nodeAgent:
      enabled: false

  # Config management feature
    galley:
      enabled: false
      k8s:
        replicaCount: 1
        resources:
          requests:
            cpu: 100m
        strategy:
          rollingUpdate:
            maxSurge: "100%"
            maxUnavailable: "25%"

  # Auto injection feature
    sidecarInjector:
      enabled: false
      k8s:
        replicaCount: 1
        strategy:
          rollingUpdate:
            maxSurge: "100%"
            maxUnavailable: "25%"

  # Istio Gateway feature
    ingressGateways:
    - name: istio-ingressgateway
      enabled: true
      k8s:
        env:
          - name: ISTIO_META_ROUTER_MODE
            value: "sni-dnat"
        service:
          ports:
            - port: 15020
              targetPort: 15020
              name: status-port
            - port: 80
              targetPort: 80
              name: http2
            - port: 443
              name: https
            - port: 15029
              targetPort: 15029
              name: kiali
            - port: 15030
              targetPort: 15030
              name: prometheus
            - port: 15031
              targetPort: 15031
              name: grafana
            - port: 15032
              targetPort: 15032
              name: tracing
            - port: 15443
              targetPort: 15443
              name: tls
            - port: 31400
              name: tcp
        hpaSpec:
          maxReplicas: 5
          minReplicas: 1
          scaleTargetRef:
            apiVersion: apps/v1
            kind: Deployment
            name: istio-ingressgateway
          metrics:
            - type: Resource
              resource:
                name: cpu
                targetAverageUtilization: 80
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 2000m
            memory: 1024Mi
        strategy:
          rollingUpdate:
            maxSurge: "100%"
            maxUnavailable: "25%"

    egressGateways:
    - name: istio-egressgateway
      enabled: false
      k8s:
        env:
          - name: ISTIO_META_ROUTER_MODE
            value: "sni-dnat"
        service:
          ports:
            - port: 80
              name: http2
            - port: 443
              name: https
            - port: 15443
              targetPort: 15443
              name: tls
        hpaSpec:
          maxReplicas: 5
          minReplicas: 1
          scaleTargetRef:
            apiVersion: apps/v1
            kind: Deployment
            name: istio-egressgateway
          metrics:
            - type: Resource
              resource:
                name: cpu
                targetAverageUtilization: 80
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 2000m
            memory: 1024Mi
        strategy:
          rollingUpdate:
            maxSurge: "100%"
            maxUnavailable: "25%"
    # Istio CNI feature
    cni:
      enabled: false

  addonComponents:
    prometheus:
      enabled: true
      k8s:
        replicaCount: 1
    kiali:
      enabled: false
      k8s:
        replicaCount: 1
    grafana:
      enabled: false
      k8s:
        replicaCount: 1
    tracing:
      enabled: false
    istiocoredns:
      enabled: false

  # Global values passed through to helm global.yaml.
  # Please keep this in sync with manifests/global.yaml
  values:
    global:
      istioNamespace: istio-system
      istiod:
        enabled: true
      logging:
        level: "default:info"
      logAsJson: false
      k8sIngress:
        enabled: false
        gatewayName: ingressgateway
        enableHttps: false
      pilotCertProvider: istiod
      jwtPolicy: third-party-jwt
      proxy:
        image: proxyv2
        clusterDomain: "cluster.local"
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 2000m
            memory: 1024Mi
        concurrency: 2
        accessLogFile: ""
        accessLogFormat: ""
        accessLogEncoding: TEXT
        envoyAccessLogService:
          enabled: false
          host: # example: accesslog-service.istio-system
          port: # example: 15000
        logLevel: warning
        componentLogLevel: "misc:error"
        dnsRefreshRate: 300s
        protocolDetectionTimeout: 100ms
        privileged: false
        enableCoreDump: false
        statusPort: 15020
        readinessInitialDelaySeconds: 1
        readinessPeriodSeconds: 2
        readinessFailureThreshold: 30
        includeIPRanges: "*"
        excludeIPRanges: ""
        excludeOutboundPorts: ""
        kubevirtInterfaces: ""
        includeInboundPorts: "*"
        excludeInboundPorts: ""
        autoInject: enabled
        envoyStatsd:
          enabled: false
          host: # example: statsd-svc.istio-system
          port: # example: 9125
        envoyMetricsService:
          enabled: false
          host: # example: metrics-service.istio-system
          port: # example: 15000
          tlsSettings:
            mode: DISABLE # DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
            clientCertificate: # example: /etc/istio/ms/cert-chain.pem
            privateKey:        # example: /etc/istio/ms/key.pem
            caCertificates:    # example: /etc/istio/ms/root-cert.pem
            sni:               # example: ms.somedomain
            subjectAltNames: []
          tcpKeepalive:
            probes: 3
            time: 10s
            interval: 10s
        tracer: "zipkin"
      proxy_init:
        image: proxyv2
        resources:
          limits:
            cpu: 100m
            memory: 50Mi
          requests:
            cpu: 10m
            memory: 10Mi
      imagePullPolicy: IfNotPresent
      certificates: []
      operatorManageWebhooks: false
      controlPlaneSecurityEnabled: true
      disablePolicyChecks: true
      policyCheckFailOpen: false
      enableTracing: true
      tracer:
        lightstep:
          address: ""                # example: lightstep-satellite:443
          accessToken: ""            # example: abcdefg1234567
          secure: true               # example: true|false
          cacertPath: ""             # example: /etc/lightstep/cacert.pem
        zipkin:
          address: ""
        datadog:
          address: "$(HOST_IP):8126"
        stackdriver:
          debug: false
          maxNumberOfAttributes: 200
          maxNumberOfAnnotations: 200
          maxNumberOfMessageEvents: 200
      mtls:
        enabled: false
        auto: true
      imagePullSecrets: []
      arch:
        amd64: 2
        s390x: 2
        ppc64le: 2
      oneNamespace: false
      defaultNodeSelector: {}
      configValidation: true
      meshExpansion:
        enabled: false
        useILB: false
      multiCluster:
        enabled: false
        clusterName: ""
      omitSidecarInjectorConfigMap: false
      network: ""
      defaultResources:
        requests:
          cpu: 10m
      defaultPodDisruptionBudget:
        enabled: true
      priorityClassName: ""
      useMCP: false
      trustDomain: "cluster.local"
      outboundTrafficPolicy:
        mode: ALLOW_ANY
      sds:
        enabled: false
        udsPath: ""
        token:
          aud: istio-ca
      sts:
        servicePort: 0
      meshNetworks: {}
      localityLbSetting:
        enabled: true
      enableHelmTest: false
      mountMtlsCerts: false
    pilot:
      autoscaleEnabled: true
      autoscaleMin: 1
      autoscaleMax: 5
      replicaCount: 1
      image: pilot
      traceSampling: 1.0
      configNamespace: istio-config
      appNamespaces: []
      env: {}
      cpu:
        targetAverageUtilization: 80
      nodeSelector: {}
      tolerations: []
      podAntiAffinityLabelSelector: []
      podAntiAffinityTermLabelSelector: []
      keepaliveMaxServerConnectionAge: 30m
      enableProtocolSniffingForOutbound: true
      enableProtocolSniffingForInbound: false
      deploymentLabels:
      meshNetworks:
        networks: {}
      configMap: true
      ingress:
        ingressService: istio-ingressgateway
        ingressControllerMode: "STRICT"
        ingressClass: istio
      policy:
        enabled: false

    telemetry:
      enabled: true
      v1:
        enabled: false
      v2:
        enabled: true
        prometheus:
          enabled: true
        stackdriver:
          enabled: false
          logging: false
          monitoring: false
          topology: false
          configOverride: {}
    mixer:
      adapters:
        stdio:
          enabled: false
          outputAsJson: false
        prometheus:
          enabled: true
          metricsExpiryDuration: 10m
        kubernetesenv:
          enabled: true
        stackdriver:
          enabled: false
          auth:
            appCredentials: false
            apiKey: ""
            serviceAccountPath: ""
          tracer:
            enabled: false
            sampleProbability: 1
        useAdapterCRDs: false

      telemetry:
        image: mixer
        replicaCount: 1
        autoscaleEnabled: true
        sessionAffinityEnabled: false
        loadshedding:
          mode: enforce
          latencyThreshold: 100ms
        reportBatchMaxEntries: 100
        reportBatchMaxTime: 1s
        env:
          GOMAXPROCS: "6"
        nodeSelector: {}
        tolerations: []
        podAntiAffinityLabelSelector: []
        podAntiAffinityTermLabelSelector: []

      policy:
        autoscaleEnabled: true
        image: mixer
        sessionAffinityEnabled: false
        adapters:
          kubernetesenv:
            enabled: true
          useAdapterCRDs: false

    galley:
      image: galley
      enableAnalysis: false

    security:
      image: citadel
      selfSigned: true # indicate if self-signed CA is used.
      enableNamespacesByDefault: true
      dnsCerts:
        istio-pilot-service-account.istio-control: istio-pilot.istio-control

    nodeagent:
      image: node-agent-k8s

    gateways:
      istio-egressgateway:
        autoscaleEnabled: true
        type: ClusterIP
        name: istio-egressgateway
        secretVolumes:
          - name: egressgateway-certs
            secretName: istio-egressgateway-certs
            mountPath: /etc/istio/egressgateway-certs
          - name: egressgateway-ca-certs
            secretName: istio-egressgateway-ca-certs
            mountPath: /etc/istio/egressgateway-ca-certs

      istio-ingressgateway:
        autoscaleEnabled: true
        applicationPorts: ""
        debug: info
        domain: ""
        type: LoadBalancer
        zvpn:
          enabled: false
          suffix: global
        sds:
          enabled: false
          image: node-agent-k8s
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 2000m
              memory: 1024Mi
        name: istio-ingressgateway
        meshExpansionPorts:
          - port: 15011
            targetPort: 15011
            name: tcp-pilot-grpc-tls
          - port: 15012
            targetPort: 15012
            name: tcp-istiod
          - port: 8060
            targetPort: 8060
            name: tcp-citadel-grpc-tls
          - port: 853
            targetPort: 853
            name: tcp-dns-tls
        secretVolumes:
          - name: ingressgateway-certs
            secretName: istio-ingressgateway-certs
            mountPath: /etc/istio/ingressgateway-certs
          - name: ingressgateway-ca-certs
            secretName: istio-ingressgateway-ca-certs
            mountPath: /etc/istio/ingressgateway-ca-certs

    sidecarInjectorWebhook:
      image: sidecar_injector
      enableNamespacesByDefault: false
      rewriteAppHTTPProbe: true
      selfSigned: false
      injectLabel: istio-injection
      objectSelector:
        enabled: false
        autoInject: true

    prometheus:
      hub: docker.io/prom
      tag: v2.15.1
      retention: 6h
      scrapeInterval: 15s
      contextPath: /prometheus
      ingress:
        enabled: false
        hosts:
          - prometheus.local
        annotations:
        tls:
      security:
        enabled: true
      nodeSelector: {}
      tolerations: []
      podAntiAffinityLabelSelector: []
      podAntiAffinityTermLabelSelector: []
      provisionPrometheusCert: true

    grafana:
      image:
        repository: grafana/grafana
        tag: 6.7.4
      persist: false
      storageClassName: ""
      accessMode: ReadWriteMany
      security:
        enabled: false
        secretName: grafana
        usernameKey: username
        passphraseKey: passphrase
      contextPath: /grafana
      service:
        annotations: {}
        name: http
        type: ClusterIP
        externalPort: 3000
        loadBalancerIP:
        loadBalancerSourceRanges:
      ingress:
        enabled: false
        hosts:
          - grafana.local
        annotations:
        tls:
      datasources:
        datasources.yaml:
          apiVersion: 1
          datasources:
      dashboardProviders:
        dashboardproviders.yaml:
          apiVersion: 1
          providers:
            - name: 'istio'
              orgId: 1
              folder: 'istio'
              type: file
              disableDeletion: false
              options:
                path: /var/lib/grafana/dashboards/istio
      nodeSelector: {}
      tolerations: []
      podAntiAffinityLabelSelector: []
      podAntiAffinityTermLabelSelector: []
      env: {}
      envSecrets: {}

    tracing:
      provider: jaeger
      nodeSelector: {}
      podAntiAffinityLabelSelector: []
      podAntiAffinityTermLabelSelector: []
      jaeger:
        hub: docker.io/jaegertracing
        tag: "1.16"
        memory:
          max_traces: 50000
        spanStorageType: badger
        persist: false
        storageClassName: ""
        accessMode: ReadWriteMany
      zipkin:
        hub: docker.io/openzipkin
        tag: 2.14.2
        probeStartupDelay: 200
        queryPort: 9411
        resources:
          limits:
            cpu: 300m
            memory: 900Mi
          requests:
            cpu: 150m
            memory: 900Mi
        javaOptsHeap: 700
        maxSpans: 500000
        node:
          cpus: 2
      opencensus:
        hub: docker.io/omnition
        tag: 0.1.9
        resources:
          limits:
            cpu: "1"
            memory: 2Gi
          requests:
            cpu: 200m
            memory: 400Mi
        exporters:
          stackdriver:
            enable_tracing: true
      service:
        annotations: {}
        name: http-query
        type: ClusterIP
        externalPort: 9411
      ingress:
        enabled: false
        hosts:
        annotations:
        tls:
    istiocoredns:
      coreDNSImage: coredns/coredns
      coreDNSTag: 1.6.2
      coreDNSPluginImage: istio/coredns-plugin:0.2-istio-1.1

    kiali:
      hub: quay.io/kiali
      tag: v1.15
      contextPath: /kiali
      nodeSelector: {}
      podAntiAffinityLabelSelector: []
      podAntiAffinityTermLabelSelector: []
      ingress:
        enabled: false
        hosts:
          - kiali.local
        annotations:
        tls:
      dashboard:
        secretName: kiali
        usernameKey: username
        passphraseKey: passphrase
        viewOnlyMode: false
        grafanaURL:
        grafanaInClusterURL: http://grafana:3000
        jaegerURL:
        jaegerInClusterURL: http://tracing/jaeger
      prometheusNamespace:
      createDemoSecret: false
      security:
        enabled: false
        cert_file: /kiali-cert/cert-chain.pem
        private_key_file: /kiali-cert/key.pem

    # TODO: derive from operator API
    version: ""
    clusterResources: true
`)

func profilesDefaultYamlBytes() ([]byte, error) {
	return _profilesDefaultYaml, nil
}

func profilesDefaultYaml() (*asset, error) {
	bytes, err := profilesDefaultYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "profiles/default.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _profilesDemoYaml = []byte(`apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    egressGateways:
    - name: istio-egressgateway
      enabled: true
      k8s:
        resources:
          requests:
            cpu: 10m
            memory: 40Mi

    ingressGateways:
    - name: istio-ingressgateway
      enabled: true
      k8s:
        resources:
          requests:
            cpu: 10m
            memory: 40Mi

    policy:
      enabled: false
      k8s:
        resources:
          requests:
            cpu: 10m
            memory: 100Mi

    telemetry:
      k8s:
        resources:
          requests:
            cpu: 50m
            memory: 100Mi

    pilot:
      k8s:
        env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: GODEBUG
            value: gctrace=1
          - name: PILOT_TRACE_SAMPLING
            value: "100"
          - name: CONFIG_NAMESPACE
            value: istio-config
        resources:
          requests:
            cpu: 10m
            memory: 100Mi

  addonComponents:
    kiali:
      enabled: true
    grafana:
      enabled: true
    tracing:
      enabled: true

  values:
    global:
      disablePolicyChecks: false
      proxy:
        accessLogFile: /dev/stdout
        resources:
          requests:
            cpu: 10m
            memory: 40Mi

    pilot:
      autoscaleEnabled: false

    mixer:
      adapters:
        useAdapterCRDs: false
        kubernetesenv:
          enabled: true
        prometheus:
          enabled: true
          metricsExpiryDuration: 10m
        stackdriver:
          enabled: false
        stdio:
          enabled: true
          outputAsJson: false
      policy:
        autoscaleEnabled: false
      telemetry:
        autoscaleEnabled: false

    gateways:
      istio-egressgateway:
        autoscaleEnabled: false
      istio-ingressgateway:
        autoscaleEnabled: false
        ports:
        ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
        # Note that AWS ELB will by default perform health checks on the first port
        # on this list. Setting this to the health check port will ensure that health
        # checks always work. https://github.com/istio/istio/issues/12503
        - port: 15020
          targetPort: 15020
          name: status-port
        - port: 80
          targetPort: 80
          name: http2
        - port: 443
          name: https
        - port: 15029
          targetPort: 15029
          name: kiali
        - port: 15030
          targetPort: 15030
          name: prometheus
        - port: 15031
          targetPort: 15031
          name: grafana
        - port: 15032
          targetPort: 15032
          name: tracing
        - port: 31400
          targetPort: 31400
          name: tcp
        - port: 15443
          targetPort: 15443
          name: tls
    kiali:
      createDemoSecret: true
`)

func profilesDemoYamlBytes() ([]byte, error) {
	return _profilesDemoYaml, nil
}

func profilesDemoYaml() (*asset, error) {
	bytes, err := profilesDemoYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "profiles/demo.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _profilesEmptyYaml = []byte(`# The empty profile has everything disabled
# This is useful as a base for custom user configuration
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  hub: gcr.io/istio-testing
  tag: latest
  meshConfig:
    rootNamespace: istio-system
  components:
    base:
      enabled: false
    pilot:
      enabled: false
    policy:
      enabled: false
    telemetry:
      enabled: false
    proxy:
      enabled: false
    sidecarInjector:
      enabled: false
    citadel:
      enabled: false
    nodeAgent:
      enabled: false
    galley:
      enabled: false
    cni:
      enabled: false
    ingressGateways:
    egressGateways:

  addonComponents:
    prometheus:
      enabled: false

  values:
    global:
      useMCP: false
      controlPlaneSecurityEnabled: false
      proxy:
        envoyStatsd:
          enabled: false
          host:
          port:
      mtls:
        auto: false

    pilot:
      sidecar: false
      useMCP: false
`)

func profilesEmptyYamlBytes() ([]byte, error) {
	return _profilesEmptyYaml, nil
}

func profilesEmptyYaml() (*asset, error) {
	bytes, err := profilesEmptyYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "profiles/empty.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _profilesMinimalYaml = []byte(`# The minimal profile will install just the core control plane
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    pilot:
      enabled: true
    policy:
      enabled: false
    telemetry:
      enabled: false
    proxy:
      enabled: false
    sidecarInjector:
      enabled: false
    citadel:
      enabled: false
    nodeAgent:
      enabled: false
    galley:
      enabled: false
    cni:
      enabled: false
    ingressGateways:
    - name: istio-ingressgateway
      enabled: false
    egressGateways:
    - name: istio-egressgateway
      enabled: false

  addonComponents:
    prometheus:
      enabled: false

  values:
    global:
      useMCP: false
      controlPlaneSecurityEnabled: false
      proxy:
        envoyStatsd:
          enabled: false
          host:
          port:
      mtls:
        auto: false

    pilot:
      sidecar: false
      useMCP: false
`)

func profilesMinimalYamlBytes() ([]byte, error) {
	return _profilesMinimalYaml, nil
}

func profilesMinimalYaml() (*asset, error) {
	bytes, err := profilesMinimalYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "profiles/minimal.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _profilesRemoteYaml = []byte(`apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  addonComponents:
    prometheus:
      enabled: false`)

func profilesRemoteYamlBytes() ([]byte, error) {
	return _profilesRemoteYaml, nil
}

func profilesRemoteYaml() (*asset, error) {
	bytes, err := profilesRemoteYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "profiles/remote.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _profilesSeparateYaml = []byte(`# The separate profile will disable istiod and bring back the old microservices model
# This will be removed in future (1.6) releases
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    sidecarInjector:
      enabled: true
    citadel:
      enabled: true
    galley:
      enabled: true
    telemetry:
      enabled: true
  values:
    telemetry:
      v1:
        enabled: true
      v2:
        enabled: false
    global:
      pilotCertProvider: kubernetes
      mountMtlsCerts: true
      istiod:
        enabled: false`)

func profilesSeparateYamlBytes() ([]byte, error) {
	return _profilesSeparateYaml, nil
}

func profilesSeparateYaml() (*asset, error) {
	bytes, err := profilesSeparateYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "profiles/separate.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _translateconfigNames15Yaml = []byte(`BundledAddonComponentNames:
  - "Prometheus"
  - "Kiali"
  - "Grafana"
  - "Tracing"
  - "Istiocoredns"
DeprecatedComponentNames:
  - "Injector"
  - "CertManager"
  - "NodeAgent"
  - "SidecarInjector"

`)

func translateconfigNames15YamlBytes() ([]byte, error) {
	return _translateconfigNames15Yaml, nil
}

func translateconfigNames15Yaml() (*asset, error) {
	bytes, err := translateconfigNames15YamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "translateConfig/names-1.5.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _translateconfigReversetranslateconfig14Yaml = []byte(`kubernetesPatternMapping:
  "{{.ValueComponentName}}.env":                   "{{.FeatureName}}.Components.{{.ComponentName}}.K8s.Env"
  "{{.ValueComponentName}}.autoscaleEnabled":      "{{.FeatureName}}.Components.{{.ComponentName}}.K8s.HpaSpec"
  "{{.ValueComponentName}}.imagePullPolicy":       "{{.FeatureName}}.Components.{{.ComponentName}}.K8s.ImagePullPolicy"
  "{{.ValueComponentName}}.nodeSelector":          "{{.FeatureName}}.Components.{{.ComponentName}}.K8s.NodeSelector"
  "{{.ValueComponentName}}.tolerations":           "{{.FeatureName}}.Components.{{.ComponentName}}.K8s.Tolerations"
  "{{.ValueComponentName}}.podDisruptionBudget":   "{{.FeatureName}}.Components.{{.ComponentName}}.K8s.PodDisruptionBudget"
  "{{.ValueComponentName}}.podAnnotations":        "{{.FeatureName}}.Components.{{.ComponentName}}.K8s.PodAnnotations"
  "{{.ValueComponentName}}.priorityClassName":     "{{.FeatureName}}.Components.{{.ComponentName}}.K8s.PriorityClassName"
  "{{.ValueComponentName}}.readinessProbe":        "{{.FeatureName}}.Components.{{.ComponentName}}.K8s.ReadinessProbe"
  "{{.ValueComponentName}}.replicaCount":          "{{.FeatureName}}.Components.{{.ComponentName}}.K8s.ReplicaCount"
  "{{.ValueComponentName}}.resources":             "{{.FeatureName}}.Components.{{.ComponentName}}.K8s.Resources"
  "{{.ValueComponentName}}.rollingMaxSurge":       "{{.FeatureName}}.Components.{{.ComponentName}}.K8s.Strategy"
  "{{.ValueComponentName}}.rollingMaxUnavailable": "{{.FeatureName}}.Components.{{.ComponentName}}.K8s.Strategy"`)

func translateconfigReversetranslateconfig14YamlBytes() ([]byte, error) {
	return _translateconfigReversetranslateconfig14Yaml, nil
}

func translateconfigReversetranslateconfig14Yaml() (*asset, error) {
	bytes, err := translateconfigReversetranslateconfig14YamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "translateConfig/reverseTranslateConfig-1.4.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _translateconfigReversetranslateconfig15Yaml = []byte(`kubernetesPatternMapping:
  "{{.ValueComponentName}}.env":                   "Components.{{.ComponentName}}.K8s.Env"
  "{{.ValueComponentName}}.autoscaleEnabled":      "Components.{{.ComponentName}}.K8s.HpaSpec"
  "{{.ValueComponentName}}.imagePullPolicy":       "Components.{{.ComponentName}}.K8s.ImagePullPolicy"
  "{{.ValueComponentName}}.nodeSelector":          "Components.{{.ComponentName}}.K8s.NodeSelector"
  "{{.ValueComponentName}}.tolerations":           "Components.{{.ComponentName}}.K8s.Tolerations"
  "{{.ValueComponentName}}.podDisruptionBudget":   "Components.{{.ComponentName}}.K8s.PodDisruptionBudget"
  "{{.ValueComponentName}}.podAnnotations":        "Components.{{.ComponentName}}.K8s.PodAnnotations"
  "{{.ValueComponentName}}.priorityClassName":     "Components.{{.ComponentName}}.K8s.PriorityClassName"
  "{{.ValueComponentName}}.readinessProbe":        "Components.{{.ComponentName}}.K8s.ReadinessProbe"
  "{{.ValueComponentName}}.replicaCount":          "Components.{{.ComponentName}}.K8s.ReplicaCount"
  "{{.ValueComponentName}}.resources":             "Components.{{.ComponentName}}.K8s.Resources"
  "{{.ValueComponentName}}.rollingMaxSurge":       "Components.{{.ComponentName}}.K8s.Strategy"
  "{{.ValueComponentName}}.rollingMaxUnavailable": "Components.{{.ComponentName}}.K8s.Strategy"
  "{{.ValueComponentName}}.serviceAnnotations":    "Components.{{.ComponentName}}.K8s.ServiceAnnotations"`)

func translateconfigReversetranslateconfig15YamlBytes() ([]byte, error) {
	return _translateconfigReversetranslateconfig15Yaml, nil
}

func translateconfigReversetranslateconfig15Yaml() (*asset, error) {
	bytes, err := translateconfigReversetranslateconfig15YamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "translateConfig/reverseTranslateConfig-1.5.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _translateconfigTranslateIcpIop15Yaml = []byte(`trafficManagement.components.pilot: components.pilot
policy.components.policy: components.policy
telemetry.components.telemetry: components.telemetry
security.components.citadel: components.citadel
security.components.nodeAgent: components.nodeAgent
configManagement.components.galley: components.galley
autoInjection.components.injector: components.sidecarInjector
cni: components.cni

gateways.components.ingressGateway: components.ingressGateways.[name:istio-ingressgateway]
gateways.components.egressGateway: components.egressGateways.[name:istio-egressgateway]

security.components.certManager: addonComponents.certManager
values.grafana.enabled: addonComponents.grafana.enabled
values.kiali.enabled: addonComponents.kiali.enabled
values.prometheus.enabled: addonComponents.prometheus.enabled
values.tracing.enabled: addonComponents.tracing.enabled

values: values
unvalidatedValues: unvalidatedValues
hub: hub
tag: tag
`)

func translateconfigTranslateIcpIop15YamlBytes() ([]byte, error) {
	return _translateconfigTranslateIcpIop15Yaml, nil
}

func translateconfigTranslateIcpIop15Yaml() (*asset, error) {
	bytes, err := translateconfigTranslateIcpIop15YamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "translateConfig/translate-ICP-IOP-1.5.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _translateconfigTranslateconfig13Yaml = []byte(`apiMapping:
  Hub:
    outPath: "global.hub"
  Tag:
    outPath: "global.tag"
  K8SDefaults:
    outPath: "global.resources"
  DefaultNamespace:
    outPath: "global.istioNamespace"
  Values.Proxy:
    outPath: "global.proxy"
  ConfigManagement.Components.Namespace:
    outPath: "global.configNamespace"
  Policy.Components.Namespace:
    outPath: "global.policyNamespace"
  Telemetry.Components.Namespace:
    outPath: "global.telemetryNamespace"
  Security.Components.Namespace:
    outPath: "global.securityNamespace"
kubernetesMapping:
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.Affinity":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.affinity"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.Env":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.containers.[name:{{.ContainerName}}].env"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.HpaSpec":
    outPath: "[HorizontalPodAutoscaler:{{.ResourceName}}].spec"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.ImagePullPolicy":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.containers.[name:{{.ContainerName}}].imagePullPolicy"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.NodeSelector":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.nodeSelector"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.PodDisruptionBudget":
    outPath: "[PodDisruptionBudget:{{.ResourceName}}].spec"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.PodAnnotations":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.metadata.annotations"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.PriorityClassName":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.priorityClassName."
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.ReadinessProbe":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.containers.[name:{{.ContainerName}}].readinessProbe"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.ReplicaCount":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.replicas"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.Resources":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.containers.[name:{{.ContainerName}}].resources"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.Strategy":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.strategy"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.Tolerations":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.tolerations"
toFeature:
    crds:               Base
    Pilot:              TrafficManagement
    Galley:             ConfigManagement
    Injector:           AutoInjection
    Policy:             Policy
    Telemetry:          Telemetry
    Citadel:            Security
    CertManager:        Security
    NodeAgent:          Security
    IngressGateway:     Gateways
    EgressGateway:      Gateways
    Cni:                Cni
    Grafana:            ThirdParty
    Prometheus:         ThirdParty
    Tracing:            ThirdParty
    PrometheusOperator: ThirdParty
    Kiali:              ThirdParty
globalNamespaces:
  Pilot:      "istioNamespace"
  Galley:     "configNamespace"
  Telemetry:  "telemetryNamespace"
  Policy:     "policyNamespace"
  Prometheus: "prometheusNamespace"
  Citadel:    "securityNamespace"
featureMaps:
  Base:
    alwaysEnabled: true
    Components:
      - crds
  TrafficManagement:
    Components:
      - Pilot
  Policy:
    Components:
      - Policy
  Telemetry:
    Components:
      - Telemetry
  Security:
    Components:
      - Citadel
      - CertManager
      - NodeAgent
  ConfigManagement:
    Components:
      - Galley
  AutoInjection:
    Components:
      - Injector
  Gateways:
    Components:
      - IngressGateway
      - EgressGateway
  Cni:
    Components:
      - Cni
  ThirdParty:
    Components:
      - Grafana
      - Prometheus
      - Tracing
      - PrometheusOperator
      - Kiali

componentMaps:
  crds:
    ToHelmValuesTreeRoot: "global"
    HelmSubdir:           "crds"
    AlwaysEnabled:        true
  Pilot:
    ResourceType:         "Deployment"
    ResourceName:         "istio-pilot"
    ContainerName:        "discovery"
    HelmSubdir:           "istio-control/istio-discovery"
    ToHelmValuesTreeRoot: "pilot"
  Galley:
    ResourceType:         "Deployment"
    ResourceName:         "istio-galley"
    ContainerName:        "galley"
    HelmSubdir:           "istio-control/istio-config"
    ToHelmValuesTreeRoot: "galley"
  Injector:
    ResourceType:         "Deployment"
    ResourceName:         "istio-sidecar-injector"
    ContainerName:        "sidecar-injector-webhook"
    HelmSubdir:           "istio-control/istio-autoinject"
    ToHelmValuesTreeRoot: "sidecarInjectorWebhook"
  Policy:
    ResourceType:         "Deployment"
    ResourceName:         "istio-policy"
    ContainerName:        "mixer"
    HelmSubdir:           "istio-policy"
    ToHelmValuesTreeRoot: "mixer.policy"
  Telemetry:
    ResourceType:        "Deployment"
    ResourceName:         "istio-telemetry"
    ContainerName:        "mixer"
    HelmSubdir:           "istio-telemetry/mixer-telemetry"
    ToHelmValuesTreeRoot: "mixer.telemetry"
  Citadel:
    ResourceType:        "Deployment"
    ResourceName:         "istio-citadel"
    ContainerName:        "citadel"
    HelmSubdir:           "security/citadel"
    ToHelmValuesTreeRoot: "security"
  NodeAgent:
    ResourceType:         "DaemonSet"
    ResourceName:         "istio-nodeagent"
    ContainerName:        "nodeagent"
    HelmSubdir:           "security/nodeagent"
    ToHelmValuesTreeRoot: "nodeagent"
  CertManager:
    ResourceType:        "Deployment"
    ResourceName:         "certmanager"
    ContainerName:        "certmanager"
    HelmSubdir:           "security/certmanager"
    ToHelmValuesTreeRoot: "certmanager"
  IngressGateway:
    ResourceType:         "Deployment"
    ResourceName:         "istio-ingressgateway"
    ContainerName:        "istio-proxy"
    HelmSubdir:           "gateways/istio-ingress"
    ToHelmValuesTreeRoot: "gateways.istio-ingressgateway"
  EgressGateway:
    ResourceType:         "Deployment"
    ResourceName:         "istio-egressgateway"
    ContainerName:        "istio-proxy"
    HelmSubdir:           "gateways/istio-egress"
    ToHelmValuesTreeRoot: "gateways.istio-egressgateway"
  Cni:
    ResourceType:         "DaemonSet"
    ResourceName:         "istio-cni-node"
    ContainerName:        "install-cni"
    HelmSubdir:           "istio-cni"
    ToHelmValuesTreeRoot: "cni"
  Tracing:
    ResourceType:         "Deployment"
    ResourceName:         "istio-tracing"
    ContainerName:        "jaeger"
    HelmSubdir:           "istio-telemetry/tracing"
    ToHelmValuesTreeRoot: "tracing.jaeger"
  PrometheusOperator:
    ResourceType:         "Deployment"
    ResourceName:         "prometheus"
    ContainerName:        "prometheus"
    HelmSubdir:           "istio-telemetry/prometheus-operator"
    ToHelmValuesTreeRoot: "prometheus"
  Kiali:
    ResourceType:         "Deployment"
    ResourceName:         "kiali"
    ContainerName:        "kiali"
    HelmSubdir:           "istio-telemetry/kiali"
    ToHelmValuesTreeRoot: "kiali"
  Grafana:
    ResourceType:        "Deployment"
    ResourceName:         "grafana"
    ContainerName:        "grafana"
    HelmSubdir:           "istio-telemetry/grafana"
    ToHelmValuesTreeRoot: "grafana"
  Prometheus:
    ResourceType:         "Deployment"
    ResourceName:         "prometheus"
    ContainerName:        "prometheus"
    HelmSubdir:           "istio-telemetry/prometheus"
    ToHelmValuesTreeRoot: "prometheus"
`)

func translateconfigTranslateconfig13YamlBytes() ([]byte, error) {
	return _translateconfigTranslateconfig13Yaml, nil
}

func translateconfigTranslateconfig13Yaml() (*asset, error) {
	bytes, err := translateconfigTranslateconfig13YamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "translateConfig/translateConfig-1.3.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _translateconfigTranslateconfig14Yaml = []byte(`apiMapping:
  Hub:
    outPath: "global.hub"
  Tag:
    outPath: "global.tag"
  K8SDefaults:
    outPath: "global.resources"
  DefaultNamespace:
    outPath: "global.istioNamespace"
  ConfigManagement.Components.Namespace:
    outPath: "global.configNamespace"
  Policy.Components.Namespace:
    outPath: "global.policyNamespace"
  Telemetry.Components.Namespace:
    outPath: "global.telemetryNamespace"
  Security.Components.Namespace:
    outPath: "global.securityNamespace"
kubernetesMapping:
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.Affinity":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.affinity"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.Env":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.containers.[name:{{.ContainerName}}].env"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.HpaSpec":
    outPath: "[HorizontalPodAutoscaler:{{.ResourceName}}].spec"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.ImagePullPolicy":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.containers.[name:{{.ContainerName}}].imagePullPolicy"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.NodeSelector":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.nodeSelector"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.PodDisruptionBudget":
    outPath: "[PodDisruptionBudget:{{.ResourceName}}].spec"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.PodAnnotations":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.metadata.annotations"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.PriorityClassName":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.priorityClassName."
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.ReadinessProbe":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.containers.[name:{{.ContainerName}}].readinessProbe"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.ReplicaCount":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.replicas"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.Resources":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.containers.[name:{{.ContainerName}}].resources"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.Strategy":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.strategy"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.Tolerations":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.tolerations"
  "{{.FeatureName}}.Components.{{.ComponentName}}.K8S.Service":
    outPath: "[Service:{{.ResourceName}}].spec"
toFeature:
    Base:               Base
    Pilot:              TrafficManagement
    Galley:             ConfigManagement
    Injector:           AutoInjection
    Policy:             Policy
    Telemetry:          Telemetry
    Citadel:            Security
    CertManager:        Security
    NodeAgent:          Security
    IngressGateway:     Gateways
    EgressGateway:      Gateways
    Cni:                Cni
    CoreDNS:            CoreDNS
    Grafana:            ThirdParty
    Prometheus:         ThirdParty
    Tracing:            ThirdParty
    PrometheusOperator: ThirdParty
    Kiali:              ThirdParty
globalNamespaces:
  Pilot:      "istioNamespace"
  Galley:     "configNamespace"
  Telemetry:  "telemetryNamespace"
  Policy:     "policyNamespace"
  Prometheus: "prometheusNamespace"
  Citadel:    "securityNamespace"
featureMaps:
  Base:
    Components:
      - Base
  TrafficManagement:
    Components:
      - Pilot
  Policy:
    Components:
      - Policy
  Telemetry:
    Components:
      - Telemetry
  Security:
    Components:
      - Citadel
      - CertManager
      - NodeAgent
  ConfigManagement:
    Components:
      - Galley
  AutoInjection:
    Components:
      - Injector
  Gateways:
    Components:
      - IngressGateway
      - EgressGateway
  Cni:
    Components:
      - Cni
  CoreDNS:
    Components:
      - CoreDNS
  ThirdParty:
    Components:
      - Grafana
      - Prometheus
      - Tracing
      - PrometheusOperator
      - Kiali

componentMaps:
  Base:
    ToHelmValuesTreeRoot: "global"
    HelmSubdir:           "base"
  Pilot:
    ResourceType:         "Deployment"
    ResourceName:         "istio-pilot"
    ContainerName:        "discovery"
    HelmSubdir:           "istio-control/istio-discovery"
    ToHelmValuesTreeRoot: "pilot"
  Galley:
    ResourceType:         "Deployment"
    ResourceName:         "istio-galley"
    ContainerName:        "galley"
    HelmSubdir:           "istio-control/istio-config"
    ToHelmValuesTreeRoot: "galley"
  Injector:
    ResourceType:         "Deployment"
    ResourceName:         "istio-sidecar-injector"
    ContainerName:        "sidecar-injector-webhook"
    HelmSubdir:           "istio-control/istio-autoinject"
    ToHelmValuesTreeRoot: "sidecarInjectorWebhook"
  Policy:
    ResourceType:         "Deployment"
    ResourceName:         "istio-policy"
    ContainerName:        "mixer"
    HelmSubdir:           "istio-policy"
    ToHelmValuesTreeRoot: "mixer.policy"
  Telemetry:
    ResourceType:        "Deployment"
    ResourceName:         "istio-telemetry"
    ContainerName:        "mixer"
    HelmSubdir:           "istio-telemetry/mixer-telemetry"
    ToHelmValuesTreeRoot: "mixer.telemetry"
  Citadel:
    ResourceType:        "Deployment"
    ResourceName:         "istio-citadel"
    ContainerName:        "citadel"
    HelmSubdir:           "security/citadel"
    ToHelmValuesTreeRoot: "security"
  NodeAgent:
    ResourceType:         "DaemonSet"
    ResourceName:         "istio-nodeagent"
    ContainerName:        "nodeagent"
    HelmSubdir:           "security/nodeagent"
    ToHelmValuesTreeRoot: "nodeagent"
  CertManager:
    ResourceType:        "Deployment"
    ResourceName:         "certmanager"
    ContainerName:        "certmanager"
    HelmSubdir:           "security/certmanager"
    ToHelmValuesTreeRoot: "certmanager"
  IngressGateway:
    ResourceType:         "Deployment"
    ResourceName:         "istio-ingressgateway"
    ContainerName:        "istio-proxy"
    HelmSubdir:           "gateways/istio-ingress"
    ToHelmValuesTreeRoot: "gateways.istio-ingressgateway"
  EgressGateway:
    ResourceType:         "Deployment"
    ResourceName:         "istio-egressgateway"
    ContainerName:        "istio-proxy"
    HelmSubdir:           "gateways/istio-egress"
    ToHelmValuesTreeRoot: "gateways.istio-egressgateway"
  Cni:
    ResourceType:         "DaemonSet"
    ResourceName:         "istio-cni-node"
    ContainerName:        "install-cni"
    HelmSubdir:           "istio-cni"
    ToHelmValuesTreeRoot: "cni"
  CoreDNS:
    ResourceType:         "Deployment"
    ResourceName:         "istiocoredns"
    ContainerName:        "coredns"
    HelmSubdir:           "istiocoredns"
    ToHelmValuesTreeRoot: "istiocoredns"
  Tracing:
    ResourceType:         "Deployment"
    ResourceName:         "istio-tracing"
    ContainerName:        "jaeger"
    HelmSubdir:           "istio-telemetry/tracing"
    ToHelmValuesTreeRoot: "tracing.jaeger"
  PrometheusOperator:
    ResourceType:         "Deployment"
    ResourceName:         "prometheus"
    ContainerName:        "prometheus"
    HelmSubdir:           "istio-telemetry/prometheus-operator"
    ToHelmValuesTreeRoot: "prometheus"
  Kiali:
    ResourceType:         "Deployment"
    ResourceName:         "kiali"
    ContainerName:        "kiali"
    HelmSubdir:           "istio-telemetry/kiali"
    ToHelmValuesTreeRoot: "kiali"
  Grafana:
    ResourceType:        "Deployment"
    ResourceName:         "grafana"
    ContainerName:        "grafana"
    HelmSubdir:           "istio-telemetry/grafana"
    ToHelmValuesTreeRoot: "grafana"
  Prometheus:
    ResourceType:         "Deployment"
    ResourceName:         "prometheus"
    ContainerName:        "prometheus"
    HelmSubdir:           "istio-telemetry/prometheus"
    ToHelmValuesTreeRoot: "prometheus"
`)

func translateconfigTranslateconfig14YamlBytes() ([]byte, error) {
	return _translateconfigTranslateconfig14Yaml, nil
}

func translateconfigTranslateconfig14Yaml() (*asset, error) {
	bytes, err := translateconfigTranslateconfig14YamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "translateConfig/translateConfig-1.4.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _translateconfigTranslateconfig15Yaml = []byte(`apiMapping:
  Hub:
    outPath: "global.hub"
  Tag:
    outPath: "global.tag"
  K8SDefaults:
    outPath: "global.resources"
  MeshConfig.rootNamespace:
    outPath: "global.istioNamespace"
  Revision:
    outPath: "global.revision"
kubernetesMapping:
  "Components.{{.ComponentName}}.K8S.Affinity":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.affinity"
  "Components.{{.ComponentName}}.K8S.Env":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.containers.[name:{{.ContainerName}}].env"
  "Components.{{.ComponentName}}.K8S.HpaSpec":
    outPath: "[HorizontalPodAutoscaler:{{.ResourceName}}].spec"
  "Components.{{.ComponentName}}.K8S.ImagePullPolicy":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.containers.[name:{{.ContainerName}}].imagePullPolicy"
  "Components.{{.ComponentName}}.K8S.NodeSelector":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.nodeSelector"
  "Components.{{.ComponentName}}.K8S.PodDisruptionBudget":
    outPath: "[PodDisruptionBudget:{{.ResourceName}}].spec"
  "Components.{{.ComponentName}}.K8S.PodAnnotations":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.metadata.annotations"
  "Components.{{.ComponentName}}.K8S.PriorityClassName":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.priorityClassName."
  "Components.{{.ComponentName}}.K8S.ReadinessProbe":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.containers.[name:{{.ContainerName}}].readinessProbe"
  "Components.{{.ComponentName}}.K8S.ReplicaCount":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.replicas"
  "Components.{{.ComponentName}}.K8S.Resources":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.containers.[name:{{.ContainerName}}].resources"
  "Components.{{.ComponentName}}.K8S.Strategy":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.strategy"
  "Components.{{.ComponentName}}.K8S.Tolerations":
    outPath: "[{{.ResourceType}}:{{.ResourceName}}].spec.template.spec.tolerations"
  "Components.{{.ComponentName}}.K8S.ServiceAnnotations":
    outPath: "[Service:{{.ResourceName}}].metadata.annotations"
  "Components.{{.ComponentName}}.K8S.Service":
    outPath: "[Service:{{.ResourceName}}].spec"
globalNamespaces:
  Pilot:      "istioNamespace"
  Galley:     "configNamespace"
  Telemetry:  "telemetryNamespace"
  Policy:     "policyNamespace"
  Prometheus: "prometheusNamespace"
  Citadel:    "securityNamespace"

componentMaps:
  Base:
    ToHelmValuesTreeRoot: "global"
    HelmSubdir:           "base"
    SkipReverseTranslate: true
  Pilot:
    ResourceType:         "Deployment"
    ResourceName:         "istiod"
    ContainerName:        "discovery"
    HelmSubdir:           "istio-control/istio-discovery"
    ToHelmValuesTreeRoot: "pilot"
  Galley:
    ResourceType:         "Deployment"
    ResourceName:         "istio-galley"
    ContainerName:        "galley"
    HelmSubdir:           "istio-control/istio-config"
    ToHelmValuesTreeRoot: "galley"
  SidecarInjector:
    ResourceType:         "Deployment"
    ResourceName:         "istio-sidecar-injector"
    ContainerName:        "sidecar-injector-webhook"
    HelmSubdir:           "istio-control/istio-autoinject"
    ToHelmValuesTreeRoot: "sidecarInjectorWebhook"
  Policy:
    ResourceType:         "Deployment"
    ResourceName:         "istio-policy"
    ContainerName:        "mixer"
    HelmSubdir:           "istio-policy"
    ToHelmValuesTreeRoot: "mixer.policy"
  Telemetry:
    ResourceType:        "Deployment"
    ResourceName:         "istio-telemetry"
    ContainerName:        "mixer"
    HelmSubdir:           "istio-telemetry/mixer-telemetry"
    ToHelmValuesTreeRoot: "mixer.telemetry"
  Citadel:
    ResourceType:        "Deployment"
    ResourceName:         "istio-citadel"
    ContainerName:        "citadel"
    HelmSubdir:           "security/citadel"
    ToHelmValuesTreeRoot: "security"
  NodeAgent:
    ResourceType:         "DaemonSet"
    ResourceName:         "istio-nodeagent"
    ContainerName:        "nodeagent"
    HelmSubdir:           "security/nodeagent"
    ToHelmValuesTreeRoot: "nodeagent"
  CertManager:
    ResourceType:        "Deployment"
    ResourceName:         "certmanager"
    ContainerName:        "certmanager"
    HelmSubdir:           "security/certmanager"
    ToHelmValuesTreeRoot: "certmanager"
    SkipReverseTranslate: true
  IngressGateways:
    ResourceType:         "Deployment"
    ResourceName:         "istio-ingressgateway"
    ContainerName:        "istio-proxy"
    HelmSubdir:           "gateways/istio-ingress"
    ToHelmValuesTreeRoot: "gateways.istio-ingressgateway"
  EgressGateways:
    ResourceType:         "Deployment"
    ResourceName:         "istio-egressgateway"
    ContainerName:        "istio-proxy"
    HelmSubdir:           "gateways/istio-egress"
    ToHelmValuesTreeRoot: "gateways.istio-egressgateway"
  Cni:
    ResourceType:         "DaemonSet"
    ResourceName:         "istio-cni-node"
    ContainerName:        "install-cni"
    HelmSubdir:           "istio-cni"
    ToHelmValuesTreeRoot: "cni"
  Istiocoredns:
    ResourceType:         "Deployment"
    ResourceName:         "istiocoredns"
    ContainerName:        "coredns"
    HelmSubdir:           "istiocoredns"
    ToHelmValuesTreeRoot: "istiocoredns"
  Tracing:
    ResourceType:         "Deployment"
    ResourceName:         "istio-tracing"
    ContainerName:        "jaeger"
    HelmSubdir:           "istio-telemetry/tracing"
    ToHelmValuesTreeRoot: "tracing.jaeger"
  PrometheusOperator:
    ResourceType:         "Deployment"
    ResourceName:         "prometheus"
    ContainerName:        "prometheus"
    HelmSubdir:           "istio-telemetry/prometheus-operator"
    ToHelmValuesTreeRoot: "prometheus"
    SkipReverseTranslate: true
  Kiali:
    ResourceType:         "Deployment"
    ResourceName:         "kiali"
    ContainerName:        "kiali"
    HelmSubdir:           "istio-telemetry/kiali"
    ToHelmValuesTreeRoot: "kiali"
  Grafana:
    ResourceType:        "Deployment"
    ResourceName:         "grafana"
    ContainerName:        "grafana"
    HelmSubdir:           "istio-telemetry/grafana"
    ToHelmValuesTreeRoot: "grafana"
  Prometheus:
    ResourceType:         "Deployment"
    ResourceName:         "prometheus"
    ContainerName:        "prometheus"
    HelmSubdir:           "istio-telemetry/prometheus"
    ToHelmValuesTreeRoot: "prometheus"
`)

func translateconfigTranslateconfig15YamlBytes() ([]byte, error) {
	return _translateconfigTranslateconfig15Yaml, nil
}

func translateconfigTranslateconfig15Yaml() (*asset, error) {
	bytes, err := translateconfigTranslateconfig15YamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "translateConfig/translateConfig-1.5.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

var _versionsYaml = []byte(`- operatorVersion: 1.3.0
  supportedIstioVersions: 1.3.0
  recommendedIstioVersions: 1.3.0
- operatorVersion: 1.3.1
  supportedIstioVersions: ">=1.3.0,<=1.3.1"
  recommendedIstioVersions: 1.3.1
- operatorVersion: 1.3.2
  supportedIstioVersions: ">=1.3.0,<=1.3.2"
  recommendedIstioVersions: 1.3.2
- operatorVersion: 1.3.3
  supportedIstioVersions: ">=1.3.0,<=1.3.3"
  recommendedIstioVersions: 1.3.3
- operatorVersion: 1.3.4
  supportedIstioVersions: ">=1.3.0,<=1.3.4"
  recommendedIstioVersions: 1.3.4
- operatorVersion: 1.3.5
  supportedIstioVersions: ">=1.3.0,<=1.3.5"
  recommendedIstioVersions: 1.3.5
- operatorVersion: 1.3.6
  supportedIstioVersions: ">=1.3.0,<=1.3.6"
  recommendedIstioVersions: 1.3.6
- operatorVersion: 1.3.7
  operatorVersionRange: ">=1.3.7,<1.4.0"
  supportedIstioVersions: ">=1.3.0,<1.4.0"
  recommendedIstioVersions: 1.3.7
- operatorVersion: 1.4.0
  supportedIstioVersions: ">=1.3.3, <1.6"
  recommendedIstioVersions: 1.4.0
- operatorVersion: 1.4.1
  supportedIstioVersions: ">=1.3.3, <1.6"
  recommendedIstioVersions: 1.4.1
- operatorVersion: 1.4.2
  supportedIstioVersions: ">=1.3.3, <1.6"
  recommendedIstioVersions: 1.4.2
- operatorVersion: 1.4.3
  operatorVersionRange: ">=1.4.3,<1.5.0"
  supportedIstioVersions: ">=1.3.3, <1.6"
  recommendedIstioVersions: 1.4.3
- operatorVersion: 1.4.4
  operatorVersionRange: ">=1.4.4,<1.5.0"
  supportedIstioVersions: ">=1.3.3, <1.6"
  recommendedIstioVersions: 1.4.4
- operatorVersion: 1.5.0
  operatorVersionRange: ">=1.5.0,<1.6.0"
  supportedIstioVersions: ">=1.4.0, <1.6"
  recommendedIstioVersions: 1.5.0
  k8sClientVersionRange: ">=1.14"
  k8sServerVersionRange: ">=1.14"
- operatorVersion: 1.6.0
  operatorVersionRange: ">=1.6.0,<1.7.0"
  supportedIstioVersions: ">=1.5.0, <1.7"
  recommendedIstioVersions: 1.6.0
  k8sClientVersionRange: ">=1.14"
  k8sServerVersionRange: ">=1.14"
`)

func versionsYamlBytes() ([]byte, error) {
	return _versionsYaml, nil
}

func versionsYaml() (*asset, error) {
	bytes, err := versionsYamlBytes()
	if err != nil {
		return nil, err
	}

	info := bindataFileInfo{name: "versions.yaml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)}
	a := &asset{bytes: bytes, info: info}
	return a, nil
}

// Asset loads and returns the asset for the given name.
// It returns an error if the asset could not be found or
// could not be loaded.
func Asset(name string) ([]byte, error) {
	cannonicalName := strings.Replace(name, "\\", "/", -1)
	if f, ok := _bindata[cannonicalName]; ok {
		a, err := f()
		if err != nil {
			return nil, fmt.Errorf("Asset %s can't read by error: %v", name, err)
		}
		return a.bytes, nil
	}
	return nil, fmt.Errorf("Asset %s not found", name)
}

// MustAsset is like Asset but panics when Asset would return an error.
// It simplifies safe initialization of global variables.
func MustAsset(name string) []byte {
	a, err := Asset(name)
	if err != nil {
		panic("asset: Asset(" + name + "): " + err.Error())
	}

	return a
}

// AssetInfo loads and returns the asset info for the given name.
// It returns an error if the asset could not be found or
// could not be loaded.
func AssetInfo(name string) (os.FileInfo, error) {
	cannonicalName := strings.Replace(name, "\\", "/", -1)
	if f, ok := _bindata[cannonicalName]; ok {
		a, err := f()
		if err != nil {
			return nil, fmt.Errorf("AssetInfo %s can't read by error: %v", name, err)
		}
		return a.info, nil
	}
	return nil, fmt.Errorf("AssetInfo %s not found", name)
}

// AssetNames returns the names of the assets.
func AssetNames() []string {
	names := make([]string, 0, len(_bindata))
	for name := range _bindata {
		names = append(names, name)
	}
	return names
}

// _bindata is a table, holding each asset generator, mapped to its name.
var _bindata = map[string]func() (*asset, error){
	"charts/base/Chart.yaml":                                                                 chartsBaseChartYaml,
	"charts/base/files/crd-all.gen.yaml":                                                     chartsBaseFilesCrdAllGenYaml,
	"charts/base/files/crd-mixer.yaml":                                                       chartsBaseFilesCrdMixerYaml,
	"charts/base/kustomization.yaml":                                                         chartsBaseKustomizationYaml,
	"charts/base/templates/clusterrole.yaml":                                                 chartsBaseTemplatesClusterroleYaml,
	"charts/base/templates/clusterrolebinding.yaml":                                          chartsBaseTemplatesClusterrolebindingYaml,
	"charts/base/templates/crds.yaml":                                                        chartsBaseTemplatesCrdsYaml,
	"charts/base/templates/endpoints.yaml":                                                   chartsBaseTemplatesEndpointsYaml,
	"charts/base/templates/namespaces.yaml":                                                  chartsBaseTemplatesNamespacesYaml,
	"charts/base/templates/serviceaccount.yaml":                                              chartsBaseTemplatesServiceaccountYaml,
	"charts/base/templates/services.yaml":                                                    chartsBaseTemplatesServicesYaml,
	"charts/base/values.yaml":                                                                chartsBaseValuesYaml,
	"charts/gateways/istio-egress/Chart.yaml":                                                chartsGatewaysIstioEgressChartYaml,
	"charts/gateways/istio-egress/NOTES.txt":                                                 chartsGatewaysIstioEgressNotesTxt,
	"charts/gateways/istio-egress/templates/_affinity.tpl":                                   chartsGatewaysIstioEgressTemplates_affinityTpl,
	"charts/gateways/istio-egress/templates/_helpers.tpl":                                    chartsGatewaysIstioEgressTemplates_helpersTpl,
	"charts/gateways/istio-egress/templates/autoscale.yaml":                                  chartsGatewaysIstioEgressTemplatesAutoscaleYaml,
	"charts/gateways/istio-egress/templates/deployment.yaml":                                 chartsGatewaysIstioEgressTemplatesDeploymentYaml,
	"charts/gateways/istio-egress/templates/poddisruptionbudget.yaml":                        chartsGatewaysIstioEgressTemplatesPoddisruptionbudgetYaml,
	"charts/gateways/istio-egress/templates/preconfigured.yaml":                              chartsGatewaysIstioEgressTemplatesPreconfiguredYaml,
	"charts/gateways/istio-egress/templates/service.yaml":                                    chartsGatewaysIstioEgressTemplatesServiceYaml,
	"charts/gateways/istio-egress/templates/serviceaccount.yaml":                             chartsGatewaysIstioEgressTemplatesServiceaccountYaml,
	"charts/gateways/istio-egress/values.yaml":                                               chartsGatewaysIstioEgressValuesYaml,
	"charts/gateways/istio-ingress/Chart.yaml":                                               chartsGatewaysIstioIngressChartYaml,
	"charts/gateways/istio-ingress/NOTES.txt":                                                chartsGatewaysIstioIngressNotesTxt,
	"charts/gateways/istio-ingress/templates/_affinity.tpl":                                  chartsGatewaysIstioIngressTemplates_affinityTpl,
	"charts/gateways/istio-ingress/templates/addongateway.yaml":                              chartsGatewaysIstioIngressTemplatesAddongatewayYaml,
	"charts/gateways/istio-ingress/templates/autoscale.yaml":                                 chartsGatewaysIstioIngressTemplatesAutoscaleYaml,
	"charts/gateways/istio-ingress/templates/certificate.yaml":                               chartsGatewaysIstioIngressTemplatesCertificateYaml,
	"charts/gateways/istio-ingress/templates/deployment.yaml":                                chartsGatewaysIstioIngressTemplatesDeploymentYaml,
	"charts/gateways/istio-ingress/templates/gateway.yaml":                                   chartsGatewaysIstioIngressTemplatesGatewayYaml,
	"charts/gateways/istio-ingress/templates/hosts.yaml":                                     chartsGatewaysIstioIngressTemplatesHostsYaml,
	"charts/gateways/istio-ingress/templates/meshexpansion.yaml":                             chartsGatewaysIstioIngressTemplatesMeshexpansionYaml,
	"charts/gateways/istio-ingress/templates/poddisruptionbudget.yaml":                       chartsGatewaysIstioIngressTemplatesPoddisruptionbudgetYaml,
	"charts/gateways/istio-ingress/templates/preconfigured.yaml":                             chartsGatewaysIstioIngressTemplatesPreconfiguredYaml,
	"charts/gateways/istio-ingress/templates/role.yaml":                                      chartsGatewaysIstioIngressTemplatesRoleYaml,
	"charts/gateways/istio-ingress/templates/rolebindings.yaml":                              chartsGatewaysIstioIngressTemplatesRolebindingsYaml,
	"charts/gateways/istio-ingress/templates/service.yaml":                                   chartsGatewaysIstioIngressTemplatesServiceYaml,
	"charts/gateways/istio-ingress/templates/serviceaccount.yaml":                            chartsGatewaysIstioIngressTemplatesServiceaccountYaml,
	"charts/gateways/istio-ingress/templates/sidecar.yaml":                                   chartsGatewaysIstioIngressTemplatesSidecarYaml,
	"charts/gateways/istio-ingress/values.yaml":                                              chartsGatewaysIstioIngressValuesYaml,
	"charts/istio-cni/Chart.yaml":                                                            chartsIstioCniChartYaml,
	"charts/istio-cni/templates/clusterrole.yaml":                                            chartsIstioCniTemplatesClusterroleYaml,
	"charts/istio-cni/templates/clusterrolebinding.yaml":                                     chartsIstioCniTemplatesClusterrolebindingYaml,
	"charts/istio-cni/templates/configmap-cni.yaml":                                          chartsIstioCniTemplatesConfigmapCniYaml,
	"charts/istio-cni/templates/daemonset.yaml":                                              chartsIstioCniTemplatesDaemonsetYaml,
	"charts/istio-cni/templates/serviceaccount.yaml":                                         chartsIstioCniTemplatesServiceaccountYaml,
	"charts/istio-cni/values.yaml":                                                           chartsIstioCniValuesYaml,
	"charts/istio-control/istio-autoinject/Chart.yaml":                                       chartsIstioControlIstioAutoinjectChartYaml,
	"charts/istio-control/istio-autoinject/NOTES.txt":                                        chartsIstioControlIstioAutoinjectNotesTxt,
	"charts/istio-control/istio-autoinject/files/injection-template.yaml":                    chartsIstioControlIstioAutoinjectFilesInjectionTemplateYaml,
	"charts/istio-control/istio-autoinject/templates/_affinity.tpl":                          chartsIstioControlIstioAutoinjectTemplates_affinityTpl,
	"charts/istio-control/istio-autoinject/templates/_helpers.tpl":                           chartsIstioControlIstioAutoinjectTemplates_helpersTpl,
	"charts/istio-control/istio-autoinject/templates/clusterrole.yaml":                       chartsIstioControlIstioAutoinjectTemplatesClusterroleYaml,
	"charts/istio-control/istio-autoinject/templates/clusterrolebinding.yaml":                chartsIstioControlIstioAutoinjectTemplatesClusterrolebindingYaml,
	"charts/istio-control/istio-autoinject/templates/configmap.yaml":                         chartsIstioControlIstioAutoinjectTemplatesConfigmapYaml,
	"charts/istio-control/istio-autoinject/templates/deployment.yaml":                        chartsIstioControlIstioAutoinjectTemplatesDeploymentYaml,
	"charts/istio-control/istio-autoinject/templates/mutatingwebhook.yaml":                   chartsIstioControlIstioAutoinjectTemplatesMutatingwebhookYaml,
	"charts/istio-control/istio-autoinject/templates/poddisruptionbudget.yaml":               chartsIstioControlIstioAutoinjectTemplatesPoddisruptionbudgetYaml,
	"charts/istio-control/istio-autoinject/templates/service.yaml":                           chartsIstioControlIstioAutoinjectTemplatesServiceYaml,
	"charts/istio-control/istio-autoinject/templates/serviceaccount.yaml":                    chartsIstioControlIstioAutoinjectTemplatesServiceaccountYaml,
	"charts/istio-control/istio-autoinject/templates/sidecar-injector-configmap.yaml":        chartsIstioControlIstioAutoinjectTemplatesSidecarInjectorConfigmapYaml,
	"charts/istio-control/istio-autoinject/values.yaml":                                      chartsIstioControlIstioAutoinjectValuesYaml,
	"charts/istio-control/istio-config/Chart.yaml":                                           chartsIstioControlIstioConfigChartYaml,
	"charts/istio-control/istio-config/OWNERS":                                               chartsIstioControlIstioConfigOwners,
	"charts/istio-control/istio-config/README.md":                                            chartsIstioControlIstioConfigReadmeMd,
	"charts/istio-control/istio-config/templates/_affinity.tpl":                              chartsIstioControlIstioConfigTemplates_affinityTpl,
	"charts/istio-control/istio-config/templates/_helpers.tpl":                               chartsIstioControlIstioConfigTemplates_helpersTpl,
	"charts/istio-control/istio-config/templates/clusterrole.yaml":                           chartsIstioControlIstioConfigTemplatesClusterroleYaml,
	"charts/istio-control/istio-config/templates/clusterrolebinding.yaml":                    chartsIstioControlIstioConfigTemplatesClusterrolebindingYaml,
	"charts/istio-control/istio-config/templates/configmap-envoy.yaml":                       chartsIstioControlIstioConfigTemplatesConfigmapEnvoyYaml,
	"charts/istio-control/istio-config/templates/configmap-mesh.yaml":                        chartsIstioControlIstioConfigTemplatesConfigmapMeshYaml,
	"charts/istio-control/istio-config/templates/configmap.yaml":                             chartsIstioControlIstioConfigTemplatesConfigmapYaml,
	"charts/istio-control/istio-config/templates/deployment.yaml":                            chartsIstioControlIstioConfigTemplatesDeploymentYaml,
	"charts/istio-control/istio-config/templates/poddisruptionbudget.yaml":                   chartsIstioControlIstioConfigTemplatesPoddisruptionbudgetYaml,
	"charts/istio-control/istio-config/templates/service.yaml":                               chartsIstioControlIstioConfigTemplatesServiceYaml,
	"charts/istio-control/istio-config/templates/serviceaccount.yaml":                        chartsIstioControlIstioConfigTemplatesServiceaccountYaml,
	"charts/istio-control/istio-config/templates/validatingwebhookconfiguration.yaml":        chartsIstioControlIstioConfigTemplatesValidatingwebhookconfigurationYaml,
	"charts/istio-control/istio-config/templates/validatingwebhookconfiguration.yaml.tpl":    chartsIstioControlIstioConfigTemplatesValidatingwebhookconfigurationYamlTpl,
	"charts/istio-control/istio-config/values.yaml":                                          chartsIstioControlIstioConfigValuesYaml,
	"charts/istio-control/istio-discovery/Chart.yaml":                                        chartsIstioControlIstioDiscoveryChartYaml,
	"charts/istio-control/istio-discovery/NOTES.txt":                                         chartsIstioControlIstioDiscoveryNotesTxt,
	"charts/istio-control/istio-discovery/files/injection-template.yaml":                     chartsIstioControlIstioDiscoveryFilesInjectionTemplateYaml,
	"charts/istio-control/istio-discovery/templates/_affinity.tpl":                           chartsIstioControlIstioDiscoveryTemplates_affinityTpl,
	"charts/istio-control/istio-discovery/templates/_helpers.tpl":                            chartsIstioControlIstioDiscoveryTemplates_helpersTpl,
	"charts/istio-control/istio-discovery/templates/autoscale.yaml":                          chartsIstioControlIstioDiscoveryTemplatesAutoscaleYaml,
	"charts/istio-control/istio-discovery/templates/clusterrole-galley-disable-webhook.yaml": chartsIstioControlIstioDiscoveryTemplatesClusterroleGalleyDisableWebhookYaml,
	"charts/istio-control/istio-discovery/templates/clusterrole.yaml":                        chartsIstioControlIstioDiscoveryTemplatesClusterroleYaml,
	"charts/istio-control/istio-discovery/templates/clusterrolebinding.yaml":                 chartsIstioControlIstioDiscoveryTemplatesClusterrolebindingYaml,
	"charts/istio-control/istio-discovery/templates/configmap-envoy.yaml":                    chartsIstioControlIstioDiscoveryTemplatesConfigmapEnvoyYaml,
	"charts/istio-control/istio-discovery/templates/configmap-jwks.yaml":                     chartsIstioControlIstioDiscoveryTemplatesConfigmapJwksYaml,
	"charts/istio-control/istio-discovery/templates/configmap.yaml":                          chartsIstioControlIstioDiscoveryTemplatesConfigmapYaml,
	"charts/istio-control/istio-discovery/templates/deployment.yaml":                         chartsIstioControlIstioDiscoveryTemplatesDeploymentYaml,
	"charts/istio-control/istio-discovery/templates/enable-mesh-mtls.yaml":                   chartsIstioControlIstioDiscoveryTemplatesEnableMeshMtlsYaml,
	"charts/istio-control/istio-discovery/templates/istiod-injector-configmap.yaml":          chartsIstioControlIstioDiscoveryTemplatesIstiodInjectorConfigmapYaml,
	"charts/istio-control/istio-discovery/templates/mutatingwebhook.yaml":                    chartsIstioControlIstioDiscoveryTemplatesMutatingwebhookYaml,
	"charts/istio-control/istio-discovery/templates/poddisruptionbudget.yaml":                chartsIstioControlIstioDiscoveryTemplatesPoddisruptionbudgetYaml,
	"charts/istio-control/istio-discovery/templates/service.yaml":                            chartsIstioControlIstioDiscoveryTemplatesServiceYaml,
	"charts/istio-control/istio-discovery/templates/serviceaccount.yaml":                     chartsIstioControlIstioDiscoveryTemplatesServiceaccountYaml,
	"charts/istio-control/istio-discovery/templates/telemetryv2_1.4.yaml":                    chartsIstioControlIstioDiscoveryTemplatesTelemetryv2_14Yaml,
	"charts/istio-control/istio-discovery/templates/telemetryv2_1.5.yaml":                    chartsIstioControlIstioDiscoveryTemplatesTelemetryv2_15Yaml,
	"charts/istio-control/istio-discovery/templates/validatingwebhookconfiguration.yaml":     chartsIstioControlIstioDiscoveryTemplatesValidatingwebhookconfigurationYaml,
	"charts/istio-control/istio-discovery/values.yaml":                                       chartsIstioControlIstioDiscoveryValuesYaml,
	"charts/istio-operator/Chart.yaml":                                                       chartsIstioOperatorChartYaml,
	"charts/istio-operator/templates/clusterrole.yaml":                                       chartsIstioOperatorTemplatesClusterroleYaml,
	"charts/istio-operator/templates/clusterrole_binding.yaml":                               chartsIstioOperatorTemplatesClusterrole_bindingYaml,
	"charts/istio-operator/templates/crd.yaml":                                               chartsIstioOperatorTemplatesCrdYaml,
	"charts/istio-operator/templates/deployment.yaml":                                        chartsIstioOperatorTemplatesDeploymentYaml,
	"charts/istio-operator/templates/namespace.yaml":                                         chartsIstioOperatorTemplatesNamespaceYaml,
	"charts/istio-operator/templates/service.yaml":                                           chartsIstioOperatorTemplatesServiceYaml,
	"charts/istio-operator/templates/service_account.yaml":                                   chartsIstioOperatorTemplatesService_accountYaml,
	"charts/istio-operator/values.yaml":                                                      chartsIstioOperatorValuesYaml,
	"charts/istio-policy/Chart.yaml":                                                         chartsIstioPolicyChartYaml,
	"charts/istio-policy/templates/_affinity.tpl":                                            chartsIstioPolicyTemplates_affinityTpl,
	"charts/istio-policy/templates/_helpers.tpl":                                             chartsIstioPolicyTemplates_helpersTpl,
	"charts/istio-policy/templates/autoscale.yaml":                                           chartsIstioPolicyTemplatesAutoscaleYaml,
	"charts/istio-policy/templates/clusterrole.yaml":                                         chartsIstioPolicyTemplatesClusterroleYaml,
	"charts/istio-policy/templates/clusterrolebinding.yaml":                                  chartsIstioPolicyTemplatesClusterrolebindingYaml,
	"charts/istio-policy/templates/config.yaml":                                              chartsIstioPolicyTemplatesConfigYaml,
	"charts/istio-policy/templates/deployment.yaml":                                          chartsIstioPolicyTemplatesDeploymentYaml,
	"charts/istio-policy/templates/poddisruptionbudget.yaml":                                 chartsIstioPolicyTemplatesPoddisruptionbudgetYaml,
	"charts/istio-policy/templates/service.yaml":                                             chartsIstioPolicyTemplatesServiceYaml,
	"charts/istio-policy/templates/serviceaccount.yaml":                                      chartsIstioPolicyTemplatesServiceaccountYaml,
	"charts/istio-policy/values.yaml":                                                        chartsIstioPolicyValuesYaml,
	"charts/istio-telemetry/grafana/Chart.yaml":                                              chartsIstioTelemetryGrafanaChartYaml,
	"charts/istio-telemetry/grafana/dashboards/citadel-dashboard.json":                       chartsIstioTelemetryGrafanaDashboardsCitadelDashboardJson,
	"charts/istio-telemetry/grafana/dashboards/galley-dashboard.json":                        chartsIstioTelemetryGrafanaDashboardsGalleyDashboardJson,
	"charts/istio-telemetry/grafana/dashboards/istio-mesh-dashboard.json":                    chartsIstioTelemetryGrafanaDashboardsIstioMeshDashboardJson,
	"charts/istio-telemetry/grafana/dashboards/istio-performance-dashboard.json":             chartsIstioTelemetryGrafanaDashboardsIstioPerformanceDashboardJson,
	"charts/istio-telemetry/grafana/dashboards/istio-service-dashboard.json":                 chartsIstioTelemetryGrafanaDashboardsIstioServiceDashboardJson,
	"charts/istio-telemetry/grafana/dashboards/istio-workload-dashboard.json":                chartsIstioTelemetryGrafanaDashboardsIstioWorkloadDashboardJson,
	"charts/istio-telemetry/grafana/dashboards/mixer-dashboard.json":                         chartsIstioTelemetryGrafanaDashboardsMixerDashboardJson,
	"charts/istio-telemetry/grafana/dashboards/pilot-dashboard.json":                         chartsIstioTelemetryGrafanaDashboardsPilotDashboardJson,
	"charts/istio-telemetry/grafana/fix_datasources.sh":                                      chartsIstioTelemetryGrafanaFix_datasourcesSh,
	"charts/istio-telemetry/grafana/templates/_affinity.tpl":                                 chartsIstioTelemetryGrafanaTemplates_affinityTpl,
	"charts/istio-telemetry/grafana/templates/configmap-dashboards.yaml":                     chartsIstioTelemetryGrafanaTemplatesConfigmapDashboardsYaml,
	"charts/istio-telemetry/grafana/templates/configmap.yaml":                                chartsIstioTelemetryGrafanaTemplatesConfigmapYaml,
	"charts/istio-telemetry/grafana/templates/deployment.yaml":                               chartsIstioTelemetryGrafanaTemplatesDeploymentYaml,
	"charts/istio-telemetry/grafana/templates/grafana-policy.yaml":                           chartsIstioTelemetryGrafanaTemplatesGrafanaPolicyYaml,
	"charts/istio-telemetry/grafana/templates/pvc.yaml":                                      chartsIstioTelemetryGrafanaTemplatesPvcYaml,
	"charts/istio-telemetry/grafana/templates/service.yaml":                                  chartsIstioTelemetryGrafanaTemplatesServiceYaml,
	"charts/istio-telemetry/grafana/templates/tests/test-grafana-connection.yaml":            chartsIstioTelemetryGrafanaTemplatesTestsTestGrafanaConnectionYaml,
	"charts/istio-telemetry/grafana/values.yaml":                                             chartsIstioTelemetryGrafanaValuesYaml,
	"charts/istio-telemetry/kiali/Chart.yaml":                                                chartsIstioTelemetryKialiChartYaml,
	"charts/istio-telemetry/kiali/templates/_affinity.tpl":                                   chartsIstioTelemetryKialiTemplates_affinityTpl,
	"charts/istio-telemetry/kiali/templates/clusterrole.yaml":                                chartsIstioTelemetryKialiTemplatesClusterroleYaml,
	"charts/istio-telemetry/kiali/templates/clusterrolebinding.yaml":                         chartsIstioTelemetryKialiTemplatesClusterrolebindingYaml,
	"charts/istio-telemetry/kiali/templates/configmap.yaml":                                  chartsIstioTelemetryKialiTemplatesConfigmapYaml,
	"charts/istio-telemetry/kiali/templates/demosecret.yaml":                                 chartsIstioTelemetryKialiTemplatesDemosecretYaml,
	"charts/istio-telemetry/kiali/templates/deployment.yaml":                                 chartsIstioTelemetryKialiTemplatesDeploymentYaml,
	"charts/istio-telemetry/kiali/templates/service.yaml":                                    chartsIstioTelemetryKialiTemplatesServiceYaml,
	"charts/istio-telemetry/kiali/templates/serviceaccount.yaml":                             chartsIstioTelemetryKialiTemplatesServiceaccountYaml,
	"charts/istio-telemetry/kiali/values.yaml":                                               chartsIstioTelemetryKialiValuesYaml,
	"charts/istio-telemetry/mixer-telemetry/Chart.yaml":                                      chartsIstioTelemetryMixerTelemetryChartYaml,
	"charts/istio-telemetry/mixer-telemetry/templates/_affinity.tpl":                         chartsIstioTelemetryMixerTelemetryTemplates_affinityTpl,
	"charts/istio-telemetry/mixer-telemetry/templates/autoscale.yaml":                        chartsIstioTelemetryMixerTelemetryTemplatesAutoscaleYaml,
	"charts/istio-telemetry/mixer-telemetry/templates/clusterrole.yaml":                      chartsIstioTelemetryMixerTelemetryTemplatesClusterroleYaml,
	"charts/istio-telemetry/mixer-telemetry/templates/clusterrolebinding.yaml":               chartsIstioTelemetryMixerTelemetryTemplatesClusterrolebindingYaml,
	"charts/istio-telemetry/mixer-telemetry/templates/config.yaml":                           chartsIstioTelemetryMixerTelemetryTemplatesConfigYaml,
	"charts/istio-telemetry/mixer-telemetry/templates/configmap-envoy.yaml":                  chartsIstioTelemetryMixerTelemetryTemplatesConfigmapEnvoyYaml,
	"charts/istio-telemetry/mixer-telemetry/templates/deployment.yaml":                       chartsIstioTelemetryMixerTelemetryTemplatesDeploymentYaml,
	"charts/istio-telemetry/mixer-telemetry/templates/poddisruptionbudget.yaml":              chartsIstioTelemetryMixerTelemetryTemplatesPoddisruptionbudgetYaml,
	"charts/istio-telemetry/mixer-telemetry/templates/service.yaml":                          chartsIstioTelemetryMixerTelemetryTemplatesServiceYaml,
	"charts/istio-telemetry/mixer-telemetry/templates/serviceaccount.yaml":                   chartsIstioTelemetryMixerTelemetryTemplatesServiceaccountYaml,
	"charts/istio-telemetry/mixer-telemetry/templates/stackdriver.yaml":                      chartsIstioTelemetryMixerTelemetryTemplatesStackdriverYaml,
	"charts/istio-telemetry/mixer-telemetry/values.yaml":                                     chartsIstioTelemetryMixerTelemetryValuesYaml,
	"charts/istio-telemetry/prometheus/Chart.yaml":                                           chartsIstioTelemetryPrometheusChartYaml,
	"charts/istio-telemetry/prometheus/templates/_affinity.tpl":                              chartsIstioTelemetryPrometheusTemplates_affinityTpl,
	"charts/istio-telemetry/prometheus/templates/clusterrole.yaml":                           chartsIstioTelemetryPrometheusTemplatesClusterroleYaml,
	"charts/istio-telemetry/prometheus/templates/clusterrolebindings.yaml":                   chartsIstioTelemetryPrometheusTemplatesClusterrolebindingsYaml,
	"charts/istio-telemetry/prometheus/templates/configmap.yaml":                             chartsIstioTelemetryPrometheusTemplatesConfigmapYaml,
	"charts/istio-telemetry/prometheus/templates/deployment.yaml":                            chartsIstioTelemetryPrometheusTemplatesDeploymentYaml,
	"charts/istio-telemetry/prometheus/templates/ingress.yaml":                               chartsIstioTelemetryPrometheusTemplatesIngressYaml,
	"charts/istio-telemetry/prometheus/templates/service.yaml":                               chartsIstioTelemetryPrometheusTemplatesServiceYaml,
	"charts/istio-telemetry/prometheus/templates/serviceaccount.yaml":                        chartsIstioTelemetryPrometheusTemplatesServiceaccountYaml,
	"charts/istio-telemetry/prometheus/templates/tests/test-prometheus-connection.yaml":      chartsIstioTelemetryPrometheusTemplatesTestsTestPrometheusConnectionYaml,
	"charts/istio-telemetry/prometheus/values.yaml":                                          chartsIstioTelemetryPrometheusValuesYaml,
	"charts/istio-telemetry/prometheus-operator/Chart.yaml":                                  chartsIstioTelemetryPrometheusOperatorChartYaml,
	"charts/istio-telemetry/prometheus-operator/templates/_affinity.tpl":                     chartsIstioTelemetryPrometheusOperatorTemplates_affinityTpl,
	"charts/istio-telemetry/prometheus-operator/templates/prometheus.yaml":                   chartsIstioTelemetryPrometheusOperatorTemplatesPrometheusYaml,
	"charts/istio-telemetry/prometheus-operator/templates/servicemonitors.yaml":              chartsIstioTelemetryPrometheusOperatorTemplatesServicemonitorsYaml,
	"charts/istio-telemetry/prometheus-operator/values.yaml":                                 chartsIstioTelemetryPrometheusOperatorValuesYaml,
	"charts/istio-telemetry/tracing/Chart.yaml":                                              chartsIstioTelemetryTracingChartYaml,
	"charts/istio-telemetry/tracing/templates/_affinity.tpl":                                 chartsIstioTelemetryTracingTemplates_affinityTpl,
	"charts/istio-telemetry/tracing/templates/deployment-jaeger.yaml":                        chartsIstioTelemetryTracingTemplatesDeploymentJaegerYaml,
	"charts/istio-telemetry/tracing/templates/deployment-opencensus.yaml":                    chartsIstioTelemetryTracingTemplatesDeploymentOpencensusYaml,
	"charts/istio-telemetry/tracing/templates/deployment-zipkin.yaml":                        chartsIstioTelemetryTracingTemplatesDeploymentZipkinYaml,
	"charts/istio-telemetry/tracing/templates/pvc.yaml":                                      chartsIstioTelemetryTracingTemplatesPvcYaml,
	"charts/istio-telemetry/tracing/templates/service-jaeger.yaml":                           chartsIstioTelemetryTracingTemplatesServiceJaegerYaml,
	"charts/istio-telemetry/tracing/templates/service.yaml":                                  chartsIstioTelemetryTracingTemplatesServiceYaml,
	"charts/istio-telemetry/tracing/values.yaml":                                             chartsIstioTelemetryTracingValuesYaml,
	"charts/istiocoredns/Chart.yaml":                                                         chartsIstiocorednsChartYaml,
	"charts/istiocoredns/templates/_affinity.tpl":                                            chartsIstiocorednsTemplates_affinityTpl,
	"charts/istiocoredns/templates/clusterrole.yaml":                                         chartsIstiocorednsTemplatesClusterroleYaml,
	"charts/istiocoredns/templates/clusterrolebinding.yaml":                                  chartsIstiocorednsTemplatesClusterrolebindingYaml,
	"charts/istiocoredns/templates/configmap.yaml":                                           chartsIstiocorednsTemplatesConfigmapYaml,
	"charts/istiocoredns/templates/deployment.yaml":                                          chartsIstiocorednsTemplatesDeploymentYaml,
	"charts/istiocoredns/templates/service.yaml":                                             chartsIstiocorednsTemplatesServiceYaml,
	"charts/istiocoredns/templates/serviceaccount.yaml":                                      chartsIstiocorednsTemplatesServiceaccountYaml,
	"charts/istiocoredns/values.yaml":                                                        chartsIstiocorednsValuesYaml,
	"charts/security/citadel/Chart.yaml":                                                     chartsSecurityCitadelChartYaml,
	"charts/security/citadel/templates/NOTES.txt":                                            chartsSecurityCitadelTemplatesNotesTxt,
	"charts/security/citadel/templates/_affinity.tpl":                                        chartsSecurityCitadelTemplates_affinityTpl,
	"charts/security/citadel/templates/_helpers.tpl":                                         chartsSecurityCitadelTemplates_helpersTpl,
	"charts/security/citadel/templates/clusterrole.yaml":                                     chartsSecurityCitadelTemplatesClusterroleYaml,
	"charts/security/citadel/templates/clusterrolebinding.yaml":                              chartsSecurityCitadelTemplatesClusterrolebindingYaml,
	"charts/security/citadel/templates/deployment.yaml":                                      chartsSecurityCitadelTemplatesDeploymentYaml,
	"charts/security/citadel/templates/poddisruptionbudget.yaml":                             chartsSecurityCitadelTemplatesPoddisruptionbudgetYaml,
	"charts/security/citadel/templates/service.yaml":                                         chartsSecurityCitadelTemplatesServiceYaml,
	"charts/security/citadel/templates/serviceaccount.yaml":                                  chartsSecurityCitadelTemplatesServiceaccountYaml,
	"charts/security/citadel/values.yaml":                                                    chartsSecurityCitadelValuesYaml,
	"charts/security/nodeagent/Chart.yaml":                                                   chartsSecurityNodeagentChartYaml,
	"charts/security/nodeagent/templates/_affinity.tpl":                                      chartsSecurityNodeagentTemplates_affinityTpl,
	"charts/security/nodeagent/templates/clusterrole.yaml":                                   chartsSecurityNodeagentTemplatesClusterroleYaml,
	"charts/security/nodeagent/templates/clusterrolebinding.yaml":                            chartsSecurityNodeagentTemplatesClusterrolebindingYaml,
	"charts/security/nodeagent/templates/daemonset.yaml":                                     chartsSecurityNodeagentTemplatesDaemonsetYaml,
	"charts/security/nodeagent/templates/serviceaccount.yaml":                                chartsSecurityNodeagentTemplatesServiceaccountYaml,
	"charts/security/nodeagent/values.yaml":                                                  chartsSecurityNodeagentValuesYaml,
	"examples/customresource/istio_v1alpha1_istiooperator_cr.yaml":                           examplesCustomresourceIstio_v1alpha1_istiooperator_crYaml,
	"examples/googleca/values-istio-google-ca.yaml":                                          examplesGooglecaValuesIstioGoogleCaYaml,
	"examples/multicluster/values-istio-multicluster-gateways.yaml":                          examplesMulticlusterValuesIstioMulticlusterGatewaysYaml,
	"examples/multicluster/values-istio-multicluster-primary.yaml":                           examplesMulticlusterValuesIstioMulticlusterPrimaryYaml,
	"examples/user-gateway/ingress-gateway-only.yaml":                                        examplesUserGatewayIngressGatewayOnlyYaml,
	"examples/vm/values-istio-meshexpansion-gateways.yaml":                                   examplesVmValuesIstioMeshexpansionGatewaysYaml,
	"examples/vm/values-istio-meshexpansion.yaml":                                            examplesVmValuesIstioMeshexpansionYaml,
	"operator-chart/Chart.yaml":                                                              operatorChartChartYaml,
	"operator-chart/templates/clusterrole.yaml":                                              operatorChartTemplatesClusterroleYaml,
	"operator-chart/templates/clusterrole_binding.yaml":                                      operatorChartTemplatesClusterrole_bindingYaml,
	"operator-chart/templates/crd.yaml":                                                      operatorChartTemplatesCrdYaml,
	"operator-chart/templates/deployment.yaml":                                               operatorChartTemplatesDeploymentYaml,
	"operator-chart/templates/namespace.yaml":                                                operatorChartTemplatesNamespaceYaml,
	"operator-chart/templates/service.yaml":                                                  operatorChartTemplatesServiceYaml,
	"operator-chart/templates/service_account.yaml":                                          operatorChartTemplatesService_accountYaml,
	"profiles/default.yaml":                                                                  profilesDefaultYaml,
	"profiles/demo.yaml":                                                                     profilesDemoYaml,
	"profiles/empty.yaml":                                                                    profilesEmptyYaml,
	"profiles/minimal.yaml":                                                                  profilesMinimalYaml,
	"profiles/remote.yaml":                                                                   profilesRemoteYaml,
	"profiles/separate.yaml":                                                                 profilesSeparateYaml,
	"translateConfig/names-1.5.yaml":                                                         translateconfigNames15Yaml,
	"translateConfig/reverseTranslateConfig-1.4.yaml":                                        translateconfigReversetranslateconfig14Yaml,
	"translateConfig/reverseTranslateConfig-1.5.yaml":                                        translateconfigReversetranslateconfig15Yaml,
	"translateConfig/translate-ICP-IOP-1.5.yaml":                                             translateconfigTranslateIcpIop15Yaml,
	"translateConfig/translateConfig-1.3.yaml":                                               translateconfigTranslateconfig13Yaml,
	"translateConfig/translateConfig-1.4.yaml":                                               translateconfigTranslateconfig14Yaml,
	"translateConfig/translateConfig-1.5.yaml":                                               translateconfigTranslateconfig15Yaml,
	"versions.yaml":                                                                          versionsYaml,
}

// AssetDir returns the file names below a certain
// directory embedded in the file by go-bindata.
// For example if you run go-bindata on data/... and data contains the
// following hierarchy:
//     data/
//       foo.txt
//       img/
//         a.png
//         b.png
// then AssetDir("data") would return []string{"foo.txt", "img"}
// AssetDir("data/img") would return []string{"a.png", "b.png"}
// AssetDir("foo.txt") and AssetDir("notexist") would return an error
// AssetDir("") will return []string{"data"}.
func AssetDir(name string) ([]string, error) {
	node := _bintree
	if len(name) != 0 {
		cannonicalName := strings.Replace(name, "\\", "/", -1)
		pathList := strings.Split(cannonicalName, "/")
		for _, p := range pathList {
			node = node.Children[p]
			if node == nil {
				return nil, fmt.Errorf("Asset %s not found", name)
			}
		}
	}
	if node.Func != nil {
		return nil, fmt.Errorf("Asset %s not found", name)
	}
	rv := make([]string, 0, len(node.Children))
	for childName := range node.Children {
		rv = append(rv, childName)
	}
	return rv, nil
}

type bintree struct {
	Func     func() (*asset, error)
	Children map[string]*bintree
}

var _bintree = &bintree{nil, map[string]*bintree{
	"charts": &bintree{nil, map[string]*bintree{
		"base": &bintree{nil, map[string]*bintree{
			"Chart.yaml": &bintree{chartsBaseChartYaml, map[string]*bintree{}},
			"files": &bintree{nil, map[string]*bintree{
				"crd-all.gen.yaml": &bintree{chartsBaseFilesCrdAllGenYaml, map[string]*bintree{}},
				"crd-mixer.yaml":   &bintree{chartsBaseFilesCrdMixerYaml, map[string]*bintree{}},
			}},
			"kustomization.yaml": &bintree{chartsBaseKustomizationYaml, map[string]*bintree{}},
			"templates": &bintree{nil, map[string]*bintree{
				"clusterrole.yaml":        &bintree{chartsBaseTemplatesClusterroleYaml, map[string]*bintree{}},
				"clusterrolebinding.yaml": &bintree{chartsBaseTemplatesClusterrolebindingYaml, map[string]*bintree{}},
				"crds.yaml":               &bintree{chartsBaseTemplatesCrdsYaml, map[string]*bintree{}},
				"endpoints.yaml":          &bintree{chartsBaseTemplatesEndpointsYaml, map[string]*bintree{}},
				"namespaces.yaml":         &bintree{chartsBaseTemplatesNamespacesYaml, map[string]*bintree{}},
				"serviceaccount.yaml":     &bintree{chartsBaseTemplatesServiceaccountYaml, map[string]*bintree{}},
				"services.yaml":           &bintree{chartsBaseTemplatesServicesYaml, map[string]*bintree{}},
			}},
			"values.yaml": &bintree{chartsBaseValuesYaml, map[string]*bintree{}},
		}},
		"gateways": &bintree{nil, map[string]*bintree{
			"istio-egress": &bintree{nil, map[string]*bintree{
				"Chart.yaml": &bintree{chartsGatewaysIstioEgressChartYaml, map[string]*bintree{}},
				"NOTES.txt":  &bintree{chartsGatewaysIstioEgressNotesTxt, map[string]*bintree{}},
				"templates": &bintree{nil, map[string]*bintree{
					"_affinity.tpl":            &bintree{chartsGatewaysIstioEgressTemplates_affinityTpl, map[string]*bintree{}},
					"_helpers.tpl":             &bintree{chartsGatewaysIstioEgressTemplates_helpersTpl, map[string]*bintree{}},
					"autoscale.yaml":           &bintree{chartsGatewaysIstioEgressTemplatesAutoscaleYaml, map[string]*bintree{}},
					"deployment.yaml":          &bintree{chartsGatewaysIstioEgressTemplatesDeploymentYaml, map[string]*bintree{}},
					"poddisruptionbudget.yaml": &bintree{chartsGatewaysIstioEgressTemplatesPoddisruptionbudgetYaml, map[string]*bintree{}},
					"preconfigured.yaml":       &bintree{chartsGatewaysIstioEgressTemplatesPreconfiguredYaml, map[string]*bintree{}},
					"service.yaml":             &bintree{chartsGatewaysIstioEgressTemplatesServiceYaml, map[string]*bintree{}},
					"serviceaccount.yaml":      &bintree{chartsGatewaysIstioEgressTemplatesServiceaccountYaml, map[string]*bintree{}},
				}},
				"values.yaml": &bintree{chartsGatewaysIstioEgressValuesYaml, map[string]*bintree{}},
			}},
			"istio-ingress": &bintree{nil, map[string]*bintree{
				"Chart.yaml": &bintree{chartsGatewaysIstioIngressChartYaml, map[string]*bintree{}},
				"NOTES.txt":  &bintree{chartsGatewaysIstioIngressNotesTxt, map[string]*bintree{}},
				"templates": &bintree{nil, map[string]*bintree{
					"_affinity.tpl":            &bintree{chartsGatewaysIstioIngressTemplates_affinityTpl, map[string]*bintree{}},
					"addongateway.yaml":        &bintree{chartsGatewaysIstioIngressTemplatesAddongatewayYaml, map[string]*bintree{}},
					"autoscale.yaml":           &bintree{chartsGatewaysIstioIngressTemplatesAutoscaleYaml, map[string]*bintree{}},
					"certificate.yaml":         &bintree{chartsGatewaysIstioIngressTemplatesCertificateYaml, map[string]*bintree{}},
					"deployment.yaml":          &bintree{chartsGatewaysIstioIngressTemplatesDeploymentYaml, map[string]*bintree{}},
					"gateway.yaml":             &bintree{chartsGatewaysIstioIngressTemplatesGatewayYaml, map[string]*bintree{}},
					"hosts.yaml":               &bintree{chartsGatewaysIstioIngressTemplatesHostsYaml, map[string]*bintree{}},
					"meshexpansion.yaml":       &bintree{chartsGatewaysIstioIngressTemplatesMeshexpansionYaml, map[string]*bintree{}},
					"poddisruptionbudget.yaml": &bintree{chartsGatewaysIstioIngressTemplatesPoddisruptionbudgetYaml, map[string]*bintree{}},
					"preconfigured.yaml":       &bintree{chartsGatewaysIstioIngressTemplatesPreconfiguredYaml, map[string]*bintree{}},
					"role.yaml":                &bintree{chartsGatewaysIstioIngressTemplatesRoleYaml, map[string]*bintree{}},
					"rolebindings.yaml":        &bintree{chartsGatewaysIstioIngressTemplatesRolebindingsYaml, map[string]*bintree{}},
					"service.yaml":             &bintree{chartsGatewaysIstioIngressTemplatesServiceYaml, map[string]*bintree{}},
					"serviceaccount.yaml":      &bintree{chartsGatewaysIstioIngressTemplatesServiceaccountYaml, map[string]*bintree{}},
					"sidecar.yaml":             &bintree{chartsGatewaysIstioIngressTemplatesSidecarYaml, map[string]*bintree{}},
				}},
				"values.yaml": &bintree{chartsGatewaysIstioIngressValuesYaml, map[string]*bintree{}},
			}},
		}},
		"istio-cni": &bintree{nil, map[string]*bintree{
			"Chart.yaml": &bintree{chartsIstioCniChartYaml, map[string]*bintree{}},
			"templates": &bintree{nil, map[string]*bintree{
				"clusterrole.yaml":        &bintree{chartsIstioCniTemplatesClusterroleYaml, map[string]*bintree{}},
				"clusterrolebinding.yaml": &bintree{chartsIstioCniTemplatesClusterrolebindingYaml, map[string]*bintree{}},
				"configmap-cni.yaml":      &bintree{chartsIstioCniTemplatesConfigmapCniYaml, map[string]*bintree{}},
				"daemonset.yaml":          &bintree{chartsIstioCniTemplatesDaemonsetYaml, map[string]*bintree{}},
				"serviceaccount.yaml":     &bintree{chartsIstioCniTemplatesServiceaccountYaml, map[string]*bintree{}},
			}},
			"values.yaml": &bintree{chartsIstioCniValuesYaml, map[string]*bintree{}},
		}},
		"istio-control": &bintree{nil, map[string]*bintree{
			"istio-autoinject": &bintree{nil, map[string]*bintree{
				"Chart.yaml": &bintree{chartsIstioControlIstioAutoinjectChartYaml, map[string]*bintree{}},
				"NOTES.txt":  &bintree{chartsIstioControlIstioAutoinjectNotesTxt, map[string]*bintree{}},
				"files": &bintree{nil, map[string]*bintree{
					"injection-template.yaml": &bintree{chartsIstioControlIstioAutoinjectFilesInjectionTemplateYaml, map[string]*bintree{}},
				}},
				"templates": &bintree{nil, map[string]*bintree{
					"_affinity.tpl":                   &bintree{chartsIstioControlIstioAutoinjectTemplates_affinityTpl, map[string]*bintree{}},
					"_helpers.tpl":                    &bintree{chartsIstioControlIstioAutoinjectTemplates_helpersTpl, map[string]*bintree{}},
					"clusterrole.yaml":                &bintree{chartsIstioControlIstioAutoinjectTemplatesClusterroleYaml, map[string]*bintree{}},
					"clusterrolebinding.yaml":         &bintree{chartsIstioControlIstioAutoinjectTemplatesClusterrolebindingYaml, map[string]*bintree{}},
					"configmap.yaml":                  &bintree{chartsIstioControlIstioAutoinjectTemplatesConfigmapYaml, map[string]*bintree{}},
					"deployment.yaml":                 &bintree{chartsIstioControlIstioAutoinjectTemplatesDeploymentYaml, map[string]*bintree{}},
					"mutatingwebhook.yaml":            &bintree{chartsIstioControlIstioAutoinjectTemplatesMutatingwebhookYaml, map[string]*bintree{}},
					"poddisruptionbudget.yaml":        &bintree{chartsIstioControlIstioAutoinjectTemplatesPoddisruptionbudgetYaml, map[string]*bintree{}},
					"service.yaml":                    &bintree{chartsIstioControlIstioAutoinjectTemplatesServiceYaml, map[string]*bintree{}},
					"serviceaccount.yaml":             &bintree{chartsIstioControlIstioAutoinjectTemplatesServiceaccountYaml, map[string]*bintree{}},
					"sidecar-injector-configmap.yaml": &bintree{chartsIstioControlIstioAutoinjectTemplatesSidecarInjectorConfigmapYaml, map[string]*bintree{}},
				}},
				"values.yaml": &bintree{chartsIstioControlIstioAutoinjectValuesYaml, map[string]*bintree{}},
			}},
			"istio-config": &bintree{nil, map[string]*bintree{
				"Chart.yaml": &bintree{chartsIstioControlIstioConfigChartYaml, map[string]*bintree{}},
				"OWNERS":     &bintree{chartsIstioControlIstioConfigOwners, map[string]*bintree{}},
				"README.md":  &bintree{chartsIstioControlIstioConfigReadmeMd, map[string]*bintree{}},
				"templates": &bintree{nil, map[string]*bintree{
					"_affinity.tpl":                           &bintree{chartsIstioControlIstioConfigTemplates_affinityTpl, map[string]*bintree{}},
					"_helpers.tpl":                            &bintree{chartsIstioControlIstioConfigTemplates_helpersTpl, map[string]*bintree{}},
					"clusterrole.yaml":                        &bintree{chartsIstioControlIstioConfigTemplatesClusterroleYaml, map[string]*bintree{}},
					"clusterrolebinding.yaml":                 &bintree{chartsIstioControlIstioConfigTemplatesClusterrolebindingYaml, map[string]*bintree{}},
					"configmap-envoy.yaml":                    &bintree{chartsIstioControlIstioConfigTemplatesConfigmapEnvoyYaml, map[string]*bintree{}},
					"configmap-mesh.yaml":                     &bintree{chartsIstioControlIstioConfigTemplatesConfigmapMeshYaml, map[string]*bintree{}},
					"configmap.yaml":                          &bintree{chartsIstioControlIstioConfigTemplatesConfigmapYaml, map[string]*bintree{}},
					"deployment.yaml":                         &bintree{chartsIstioControlIstioConfigTemplatesDeploymentYaml, map[string]*bintree{}},
					"poddisruptionbudget.yaml":                &bintree{chartsIstioControlIstioConfigTemplatesPoddisruptionbudgetYaml, map[string]*bintree{}},
					"service.yaml":                            &bintree{chartsIstioControlIstioConfigTemplatesServiceYaml, map[string]*bintree{}},
					"serviceaccount.yaml":                     &bintree{chartsIstioControlIstioConfigTemplatesServiceaccountYaml, map[string]*bintree{}},
					"validatingwebhookconfiguration.yaml":     &bintree{chartsIstioControlIstioConfigTemplatesValidatingwebhookconfigurationYaml, map[string]*bintree{}},
					"validatingwebhookconfiguration.yaml.tpl": &bintree{chartsIstioControlIstioConfigTemplatesValidatingwebhookconfigurationYamlTpl, map[string]*bintree{}},
				}},
				"values.yaml": &bintree{chartsIstioControlIstioConfigValuesYaml, map[string]*bintree{}},
			}},
			"istio-discovery": &bintree{nil, map[string]*bintree{
				"Chart.yaml": &bintree{chartsIstioControlIstioDiscoveryChartYaml, map[string]*bintree{}},
				"NOTES.txt":  &bintree{chartsIstioControlIstioDiscoveryNotesTxt, map[string]*bintree{}},
				"files": &bintree{nil, map[string]*bintree{
					"injection-template.yaml": &bintree{chartsIstioControlIstioDiscoveryFilesInjectionTemplateYaml, map[string]*bintree{}},
				}},
				"templates": &bintree{nil, map[string]*bintree{
					"_affinity.tpl":                           &bintree{chartsIstioControlIstioDiscoveryTemplates_affinityTpl, map[string]*bintree{}},
					"_helpers.tpl":                            &bintree{chartsIstioControlIstioDiscoveryTemplates_helpersTpl, map[string]*bintree{}},
					"autoscale.yaml":                          &bintree{chartsIstioControlIstioDiscoveryTemplatesAutoscaleYaml, map[string]*bintree{}},
					"clusterrole-galley-disable-webhook.yaml": &bintree{chartsIstioControlIstioDiscoveryTemplatesClusterroleGalleyDisableWebhookYaml, map[string]*bintree{}},
					"clusterrole.yaml":                        &bintree{chartsIstioControlIstioDiscoveryTemplatesClusterroleYaml, map[string]*bintree{}},
					"clusterrolebinding.yaml":                 &bintree{chartsIstioControlIstioDiscoveryTemplatesClusterrolebindingYaml, map[string]*bintree{}},
					"configmap-envoy.yaml":                    &bintree{chartsIstioControlIstioDiscoveryTemplatesConfigmapEnvoyYaml, map[string]*bintree{}},
					"configmap-jwks.yaml":                     &bintree{chartsIstioControlIstioDiscoveryTemplatesConfigmapJwksYaml, map[string]*bintree{}},
					"configmap.yaml":                          &bintree{chartsIstioControlIstioDiscoveryTemplatesConfigmapYaml, map[string]*bintree{}},
					"deployment.yaml":                         &bintree{chartsIstioControlIstioDiscoveryTemplatesDeploymentYaml, map[string]*bintree{}},
					"enable-mesh-mtls.yaml":                   &bintree{chartsIstioControlIstioDiscoveryTemplatesEnableMeshMtlsYaml, map[string]*bintree{}},
					"istiod-injector-configmap.yaml":          &bintree{chartsIstioControlIstioDiscoveryTemplatesIstiodInjectorConfigmapYaml, map[string]*bintree{}},
					"mutatingwebhook.yaml":                    &bintree{chartsIstioControlIstioDiscoveryTemplatesMutatingwebhookYaml, map[string]*bintree{}},
					"poddisruptionbudget.yaml":                &bintree{chartsIstioControlIstioDiscoveryTemplatesPoddisruptionbudgetYaml, map[string]*bintree{}},
					"service.yaml":                            &bintree{chartsIstioControlIstioDiscoveryTemplatesServiceYaml, map[string]*bintree{}},
					"serviceaccount.yaml":                     &bintree{chartsIstioControlIstioDiscoveryTemplatesServiceaccountYaml, map[string]*bintree{}},
					"telemetryv2_1.4.yaml":                    &bintree{chartsIstioControlIstioDiscoveryTemplatesTelemetryv2_14Yaml, map[string]*bintree{}},
					"telemetryv2_1.5.yaml":                    &bintree{chartsIstioControlIstioDiscoveryTemplatesTelemetryv2_15Yaml, map[string]*bintree{}},
					"validatingwebhookconfiguration.yaml":     &bintree{chartsIstioControlIstioDiscoveryTemplatesValidatingwebhookconfigurationYaml, map[string]*bintree{}},
				}},
				"values.yaml": &bintree{chartsIstioControlIstioDiscoveryValuesYaml, map[string]*bintree{}},
			}},
		}},
		"istio-operator": &bintree{nil, map[string]*bintree{
			"Chart.yaml": &bintree{chartsIstioOperatorChartYaml, map[string]*bintree{}},
			"templates": &bintree{nil, map[string]*bintree{
				"clusterrole.yaml":         &bintree{chartsIstioOperatorTemplatesClusterroleYaml, map[string]*bintree{}},
				"clusterrole_binding.yaml": &bintree{chartsIstioOperatorTemplatesClusterrole_bindingYaml, map[string]*bintree{}},
				"crd.yaml":                 &bintree{chartsIstioOperatorTemplatesCrdYaml, map[string]*bintree{}},
				"deployment.yaml":          &bintree{chartsIstioOperatorTemplatesDeploymentYaml, map[string]*bintree{}},
				"namespace.yaml":           &bintree{chartsIstioOperatorTemplatesNamespaceYaml, map[string]*bintree{}},
				"service.yaml":             &bintree{chartsIstioOperatorTemplatesServiceYaml, map[string]*bintree{}},
				"service_account.yaml":     &bintree{chartsIstioOperatorTemplatesService_accountYaml, map[string]*bintree{}},
			}},
			"values.yaml": &bintree{chartsIstioOperatorValuesYaml, map[string]*bintree{}},
		}},
		"istio-policy": &bintree{nil, map[string]*bintree{
			"Chart.yaml": &bintree{chartsIstioPolicyChartYaml, map[string]*bintree{}},
			"templates": &bintree{nil, map[string]*bintree{
				"_affinity.tpl":            &bintree{chartsIstioPolicyTemplates_affinityTpl, map[string]*bintree{}},
				"_helpers.tpl":             &bintree{chartsIstioPolicyTemplates_helpersTpl, map[string]*bintree{}},
				"autoscale.yaml":           &bintree{chartsIstioPolicyTemplatesAutoscaleYaml, map[string]*bintree{}},
				"clusterrole.yaml":         &bintree{chartsIstioPolicyTemplatesClusterroleYaml, map[string]*bintree{}},
				"clusterrolebinding.yaml":  &bintree{chartsIstioPolicyTemplatesClusterrolebindingYaml, map[string]*bintree{}},
				"config.yaml":              &bintree{chartsIstioPolicyTemplatesConfigYaml, map[string]*bintree{}},
				"deployment.yaml":          &bintree{chartsIstioPolicyTemplatesDeploymentYaml, map[string]*bintree{}},
				"poddisruptionbudget.yaml": &bintree{chartsIstioPolicyTemplatesPoddisruptionbudgetYaml, map[string]*bintree{}},
				"service.yaml":             &bintree{chartsIstioPolicyTemplatesServiceYaml, map[string]*bintree{}},
				"serviceaccount.yaml":      &bintree{chartsIstioPolicyTemplatesServiceaccountYaml, map[string]*bintree{}},
			}},
			"values.yaml": &bintree{chartsIstioPolicyValuesYaml, map[string]*bintree{}},
		}},
		"istio-telemetry": &bintree{nil, map[string]*bintree{
			"grafana": &bintree{nil, map[string]*bintree{
				"Chart.yaml": &bintree{chartsIstioTelemetryGrafanaChartYaml, map[string]*bintree{}},
				"dashboards": &bintree{nil, map[string]*bintree{
					"citadel-dashboard.json":           &bintree{chartsIstioTelemetryGrafanaDashboardsCitadelDashboardJson, map[string]*bintree{}},
					"galley-dashboard.json":            &bintree{chartsIstioTelemetryGrafanaDashboardsGalleyDashboardJson, map[string]*bintree{}},
					"istio-mesh-dashboard.json":        &bintree{chartsIstioTelemetryGrafanaDashboardsIstioMeshDashboardJson, map[string]*bintree{}},
					"istio-performance-dashboard.json": &bintree{chartsIstioTelemetryGrafanaDashboardsIstioPerformanceDashboardJson, map[string]*bintree{}},
					"istio-service-dashboard.json":     &bintree{chartsIstioTelemetryGrafanaDashboardsIstioServiceDashboardJson, map[string]*bintree{}},
					"istio-workload-dashboard.json":    &bintree{chartsIstioTelemetryGrafanaDashboardsIstioWorkloadDashboardJson, map[string]*bintree{}},
					"mixer-dashboard.json":             &bintree{chartsIstioTelemetryGrafanaDashboardsMixerDashboardJson, map[string]*bintree{}},
					"pilot-dashboard.json":             &bintree{chartsIstioTelemetryGrafanaDashboardsPilotDashboardJson, map[string]*bintree{}},
				}},
				"fix_datasources.sh": &bintree{chartsIstioTelemetryGrafanaFix_datasourcesSh, map[string]*bintree{}},
				"templates": &bintree{nil, map[string]*bintree{
					"_affinity.tpl":             &bintree{chartsIstioTelemetryGrafanaTemplates_affinityTpl, map[string]*bintree{}},
					"configmap-dashboards.yaml": &bintree{chartsIstioTelemetryGrafanaTemplatesConfigmapDashboardsYaml, map[string]*bintree{}},
					"configmap.yaml":            &bintree{chartsIstioTelemetryGrafanaTemplatesConfigmapYaml, map[string]*bintree{}},
					"deployment.yaml":           &bintree{chartsIstioTelemetryGrafanaTemplatesDeploymentYaml, map[string]*bintree{}},
					"grafana-policy.yaml":       &bintree{chartsIstioTelemetryGrafanaTemplatesGrafanaPolicyYaml, map[string]*bintree{}},
					"pvc.yaml":                  &bintree{chartsIstioTelemetryGrafanaTemplatesPvcYaml, map[string]*bintree{}},
					"service.yaml":              &bintree{chartsIstioTelemetryGrafanaTemplatesServiceYaml, map[string]*bintree{}},
					"tests": &bintree{nil, map[string]*bintree{
						"test-grafana-connection.yaml": &bintree{chartsIstioTelemetryGrafanaTemplatesTestsTestGrafanaConnectionYaml, map[string]*bintree{}},
					}},
				}},
				"values.yaml": &bintree{chartsIstioTelemetryGrafanaValuesYaml, map[string]*bintree{}},
			}},
			"kiali": &bintree{nil, map[string]*bintree{
				"Chart.yaml": &bintree{chartsIstioTelemetryKialiChartYaml, map[string]*bintree{}},
				"templates": &bintree{nil, map[string]*bintree{
					"_affinity.tpl":           &bintree{chartsIstioTelemetryKialiTemplates_affinityTpl, map[string]*bintree{}},
					"clusterrole.yaml":        &bintree{chartsIstioTelemetryKialiTemplatesClusterroleYaml, map[string]*bintree{}},
					"clusterrolebinding.yaml": &bintree{chartsIstioTelemetryKialiTemplatesClusterrolebindingYaml, map[string]*bintree{}},
					"configmap.yaml":          &bintree{chartsIstioTelemetryKialiTemplatesConfigmapYaml, map[string]*bintree{}},
					"demosecret.yaml":         &bintree{chartsIstioTelemetryKialiTemplatesDemosecretYaml, map[string]*bintree{}},
					"deployment.yaml":         &bintree{chartsIstioTelemetryKialiTemplatesDeploymentYaml, map[string]*bintree{}},
					"service.yaml":            &bintree{chartsIstioTelemetryKialiTemplatesServiceYaml, map[string]*bintree{}},
					"serviceaccount.yaml":     &bintree{chartsIstioTelemetryKialiTemplatesServiceaccountYaml, map[string]*bintree{}},
				}},
				"values.yaml": &bintree{chartsIstioTelemetryKialiValuesYaml, map[string]*bintree{}},
			}},
			"mixer-telemetry": &bintree{nil, map[string]*bintree{
				"Chart.yaml": &bintree{chartsIstioTelemetryMixerTelemetryChartYaml, map[string]*bintree{}},
				"templates": &bintree{nil, map[string]*bintree{
					"_affinity.tpl":            &bintree{chartsIstioTelemetryMixerTelemetryTemplates_affinityTpl, map[string]*bintree{}},
					"autoscale.yaml":           &bintree{chartsIstioTelemetryMixerTelemetryTemplatesAutoscaleYaml, map[string]*bintree{}},
					"clusterrole.yaml":         &bintree{chartsIstioTelemetryMixerTelemetryTemplatesClusterroleYaml, map[string]*bintree{}},
					"clusterrolebinding.yaml":  &bintree{chartsIstioTelemetryMixerTelemetryTemplatesClusterrolebindingYaml, map[string]*bintree{}},
					"config.yaml":              &bintree{chartsIstioTelemetryMixerTelemetryTemplatesConfigYaml, map[string]*bintree{}},
					"configmap-envoy.yaml":     &bintree{chartsIstioTelemetryMixerTelemetryTemplatesConfigmapEnvoyYaml, map[string]*bintree{}},
					"deployment.yaml":          &bintree{chartsIstioTelemetryMixerTelemetryTemplatesDeploymentYaml, map[string]*bintree{}},
					"poddisruptionbudget.yaml": &bintree{chartsIstioTelemetryMixerTelemetryTemplatesPoddisruptionbudgetYaml, map[string]*bintree{}},
					"service.yaml":             &bintree{chartsIstioTelemetryMixerTelemetryTemplatesServiceYaml, map[string]*bintree{}},
					"serviceaccount.yaml":      &bintree{chartsIstioTelemetryMixerTelemetryTemplatesServiceaccountYaml, map[string]*bintree{}},
					"stackdriver.yaml":         &bintree{chartsIstioTelemetryMixerTelemetryTemplatesStackdriverYaml, map[string]*bintree{}},
				}},
				"values.yaml": &bintree{chartsIstioTelemetryMixerTelemetryValuesYaml, map[string]*bintree{}},
			}},
			"prometheus": &bintree{nil, map[string]*bintree{
				"Chart.yaml": &bintree{chartsIstioTelemetryPrometheusChartYaml, map[string]*bintree{}},
				"templates": &bintree{nil, map[string]*bintree{
					"_affinity.tpl":            &bintree{chartsIstioTelemetryPrometheusTemplates_affinityTpl, map[string]*bintree{}},
					"clusterrole.yaml":         &bintree{chartsIstioTelemetryPrometheusTemplatesClusterroleYaml, map[string]*bintree{}},
					"clusterrolebindings.yaml": &bintree{chartsIstioTelemetryPrometheusTemplatesClusterrolebindingsYaml, map[string]*bintree{}},
					"configmap.yaml":           &bintree{chartsIstioTelemetryPrometheusTemplatesConfigmapYaml, map[string]*bintree{}},
					"deployment.yaml":          &bintree{chartsIstioTelemetryPrometheusTemplatesDeploymentYaml, map[string]*bintree{}},
					"ingress.yaml":             &bintree{chartsIstioTelemetryPrometheusTemplatesIngressYaml, map[string]*bintree{}},
					"service.yaml":             &bintree{chartsIstioTelemetryPrometheusTemplatesServiceYaml, map[string]*bintree{}},
					"serviceaccount.yaml":      &bintree{chartsIstioTelemetryPrometheusTemplatesServiceaccountYaml, map[string]*bintree{}},
					"tests": &bintree{nil, map[string]*bintree{
						"test-prometheus-connection.yaml": &bintree{chartsIstioTelemetryPrometheusTemplatesTestsTestPrometheusConnectionYaml, map[string]*bintree{}},
					}},
				}},
				"values.yaml": &bintree{chartsIstioTelemetryPrometheusValuesYaml, map[string]*bintree{}},
			}},
			"prometheus-operator": &bintree{nil, map[string]*bintree{
				"Chart.yaml": &bintree{chartsIstioTelemetryPrometheusOperatorChartYaml, map[string]*bintree{}},
				"templates": &bintree{nil, map[string]*bintree{
					"_affinity.tpl":        &bintree{chartsIstioTelemetryPrometheusOperatorTemplates_affinityTpl, map[string]*bintree{}},
					"prometheus.yaml":      &bintree{chartsIstioTelemetryPrometheusOperatorTemplatesPrometheusYaml, map[string]*bintree{}},
					"servicemonitors.yaml": &bintree{chartsIstioTelemetryPrometheusOperatorTemplatesServicemonitorsYaml, map[string]*bintree{}},
				}},
				"values.yaml": &bintree{chartsIstioTelemetryPrometheusOperatorValuesYaml, map[string]*bintree{}},
			}},
			"tracing": &bintree{nil, map[string]*bintree{
				"Chart.yaml": &bintree{chartsIstioTelemetryTracingChartYaml, map[string]*bintree{}},
				"templates": &bintree{nil, map[string]*bintree{
					"_affinity.tpl":              &bintree{chartsIstioTelemetryTracingTemplates_affinityTpl, map[string]*bintree{}},
					"deployment-jaeger.yaml":     &bintree{chartsIstioTelemetryTracingTemplatesDeploymentJaegerYaml, map[string]*bintree{}},
					"deployment-opencensus.yaml": &bintree{chartsIstioTelemetryTracingTemplatesDeploymentOpencensusYaml, map[string]*bintree{}},
					"deployment-zipkin.yaml":     &bintree{chartsIstioTelemetryTracingTemplatesDeploymentZipkinYaml, map[string]*bintree{}},
					"pvc.yaml":                   &bintree{chartsIstioTelemetryTracingTemplatesPvcYaml, map[string]*bintree{}},
					"service-jaeger.yaml":        &bintree{chartsIstioTelemetryTracingTemplatesServiceJaegerYaml, map[string]*bintree{}},
					"service.yaml":               &bintree{chartsIstioTelemetryTracingTemplatesServiceYaml, map[string]*bintree{}},
				}},
				"values.yaml": &bintree{chartsIstioTelemetryTracingValuesYaml, map[string]*bintree{}},
			}},
		}},
		"istiocoredns": &bintree{nil, map[string]*bintree{
			"Chart.yaml": &bintree{chartsIstiocorednsChartYaml, map[string]*bintree{}},
			"templates": &bintree{nil, map[string]*bintree{
				"_affinity.tpl":           &bintree{chartsIstiocorednsTemplates_affinityTpl, map[string]*bintree{}},
				"clusterrole.yaml":        &bintree{chartsIstiocorednsTemplatesClusterroleYaml, map[string]*bintree{}},
				"clusterrolebinding.yaml": &bintree{chartsIstiocorednsTemplatesClusterrolebindingYaml, map[string]*bintree{}},
				"configmap.yaml":          &bintree{chartsIstiocorednsTemplatesConfigmapYaml, map[string]*bintree{}},
				"deployment.yaml":         &bintree{chartsIstiocorednsTemplatesDeploymentYaml, map[string]*bintree{}},
				"service.yaml":            &bintree{chartsIstiocorednsTemplatesServiceYaml, map[string]*bintree{}},
				"serviceaccount.yaml":     &bintree{chartsIstiocorednsTemplatesServiceaccountYaml, map[string]*bintree{}},
			}},
			"values.yaml": &bintree{chartsIstiocorednsValuesYaml, map[string]*bintree{}},
		}},
		"security": &bintree{nil, map[string]*bintree{
			"citadel": &bintree{nil, map[string]*bintree{
				"Chart.yaml": &bintree{chartsSecurityCitadelChartYaml, map[string]*bintree{}},
				"templates": &bintree{nil, map[string]*bintree{
					"NOTES.txt":                &bintree{chartsSecurityCitadelTemplatesNotesTxt, map[string]*bintree{}},
					"_affinity.tpl":            &bintree{chartsSecurityCitadelTemplates_affinityTpl, map[string]*bintree{}},
					"_helpers.tpl":             &bintree{chartsSecurityCitadelTemplates_helpersTpl, map[string]*bintree{}},
					"clusterrole.yaml":         &bintree{chartsSecurityCitadelTemplatesClusterroleYaml, map[string]*bintree{}},
					"clusterrolebinding.yaml":  &bintree{chartsSecurityCitadelTemplatesClusterrolebindingYaml, map[string]*bintree{}},
					"deployment.yaml":          &bintree{chartsSecurityCitadelTemplatesDeploymentYaml, map[string]*bintree{}},
					"poddisruptionbudget.yaml": &bintree{chartsSecurityCitadelTemplatesPoddisruptionbudgetYaml, map[string]*bintree{}},
					"service.yaml":             &bintree{chartsSecurityCitadelTemplatesServiceYaml, map[string]*bintree{}},
					"serviceaccount.yaml":      &bintree{chartsSecurityCitadelTemplatesServiceaccountYaml, map[string]*bintree{}},
				}},
				"values.yaml": &bintree{chartsSecurityCitadelValuesYaml, map[string]*bintree{}},
			}},
			"nodeagent": &bintree{nil, map[string]*bintree{
				"Chart.yaml": &bintree{chartsSecurityNodeagentChartYaml, map[string]*bintree{}},
				"templates": &bintree{nil, map[string]*bintree{
					"_affinity.tpl":           &bintree{chartsSecurityNodeagentTemplates_affinityTpl, map[string]*bintree{}},
					"clusterrole.yaml":        &bintree{chartsSecurityNodeagentTemplatesClusterroleYaml, map[string]*bintree{}},
					"clusterrolebinding.yaml": &bintree{chartsSecurityNodeagentTemplatesClusterrolebindingYaml, map[string]*bintree{}},
					"daemonset.yaml":          &bintree{chartsSecurityNodeagentTemplatesDaemonsetYaml, map[string]*bintree{}},
					"serviceaccount.yaml":     &bintree{chartsSecurityNodeagentTemplatesServiceaccountYaml, map[string]*bintree{}},
				}},
				"values.yaml": &bintree{chartsSecurityNodeagentValuesYaml, map[string]*bintree{}},
			}},
		}},
	}},
	"examples": &bintree{nil, map[string]*bintree{
		"customresource": &bintree{nil, map[string]*bintree{
			"istio_v1alpha1_istiooperator_cr.yaml": &bintree{examplesCustomresourceIstio_v1alpha1_istiooperator_crYaml, map[string]*bintree{}},
		}},
		"googleca": &bintree{nil, map[string]*bintree{
			"values-istio-google-ca.yaml": &bintree{examplesGooglecaValuesIstioGoogleCaYaml, map[string]*bintree{}},
		}},
		"multicluster": &bintree{nil, map[string]*bintree{
			"values-istio-multicluster-gateways.yaml": &bintree{examplesMulticlusterValuesIstioMulticlusterGatewaysYaml, map[string]*bintree{}},
			"values-istio-multicluster-primary.yaml":  &bintree{examplesMulticlusterValuesIstioMulticlusterPrimaryYaml, map[string]*bintree{}},
		}},
		"user-gateway": &bintree{nil, map[string]*bintree{
			"ingress-gateway-only.yaml": &bintree{examplesUserGatewayIngressGatewayOnlyYaml, map[string]*bintree{}},
		}},
		"vm": &bintree{nil, map[string]*bintree{
			"values-istio-meshexpansion-gateways.yaml": &bintree{examplesVmValuesIstioMeshexpansionGatewaysYaml, map[string]*bintree{}},
			"values-istio-meshexpansion.yaml":          &bintree{examplesVmValuesIstioMeshexpansionYaml, map[string]*bintree{}},
		}},
	}},
	"operator-chart": &bintree{nil, map[string]*bintree{
		"Chart.yaml": &bintree{operatorChartChartYaml, map[string]*bintree{}},
		"templates": &bintree{nil, map[string]*bintree{
			"clusterrole.yaml":         &bintree{operatorChartTemplatesClusterroleYaml, map[string]*bintree{}},
			"clusterrole_binding.yaml": &bintree{operatorChartTemplatesClusterrole_bindingYaml, map[string]*bintree{}},
			"crd.yaml":                 &bintree{operatorChartTemplatesCrdYaml, map[string]*bintree{}},
			"deployment.yaml":          &bintree{operatorChartTemplatesDeploymentYaml, map[string]*bintree{}},
			"namespace.yaml":           &bintree{operatorChartTemplatesNamespaceYaml, map[string]*bintree{}},
			"service.yaml":             &bintree{operatorChartTemplatesServiceYaml, map[string]*bintree{}},
			"service_account.yaml":     &bintree{operatorChartTemplatesService_accountYaml, map[string]*bintree{}},
		}},
	}},
	"profiles": &bintree{nil, map[string]*bintree{
		"default.yaml":  &bintree{profilesDefaultYaml, map[string]*bintree{}},
		"demo.yaml":     &bintree{profilesDemoYaml, map[string]*bintree{}},
		"empty.yaml":    &bintree{profilesEmptyYaml, map[string]*bintree{}},
		"minimal.yaml":  &bintree{profilesMinimalYaml, map[string]*bintree{}},
		"remote.yaml":   &bintree{profilesRemoteYaml, map[string]*bintree{}},
		"separate.yaml": &bintree{profilesSeparateYaml, map[string]*bintree{}},
	}},
	"translateConfig": &bintree{nil, map[string]*bintree{
		"names-1.5.yaml":                  &bintree{translateconfigNames15Yaml, map[string]*bintree{}},
		"reverseTranslateConfig-1.4.yaml": &bintree{translateconfigReversetranslateconfig14Yaml, map[string]*bintree{}},
		"reverseTranslateConfig-1.5.yaml": &bintree{translateconfigReversetranslateconfig15Yaml, map[string]*bintree{}},
		"translate-ICP-IOP-1.5.yaml":      &bintree{translateconfigTranslateIcpIop15Yaml, map[string]*bintree{}},
		"translateConfig-1.3.yaml":        &bintree{translateconfigTranslateconfig13Yaml, map[string]*bintree{}},
		"translateConfig-1.4.yaml":        &bintree{translateconfigTranslateconfig14Yaml, map[string]*bintree{}},
		"translateConfig-1.5.yaml":        &bintree{translateconfigTranslateconfig15Yaml, map[string]*bintree{}},
	}},
	"versions.yaml": &bintree{versionsYaml, map[string]*bintree{}},
}}

// RestoreAsset restores an asset under the given directory
func RestoreAsset(dir, name string) error {
	data, err := Asset(name)
	if err != nil {
		return err
	}
	info, err := AssetInfo(name)
	if err != nil {
		return err
	}
	err = os.MkdirAll(_filePath(dir, filepath.Dir(name)), os.FileMode(0755))
	if err != nil {
		return err
	}
	err = ioutil.WriteFile(_filePath(dir, name), data, info.Mode())
	if err != nil {
		return err
	}
	err = os.Chtimes(_filePath(dir, name), info.ModTime(), info.ModTime())
	if err != nil {
		return err
	}
	return nil
}

// RestoreAssets restores an asset under the given directory recursively
func RestoreAssets(dir, name string) error {
	children, err := AssetDir(name)
	// File
	if err != nil {
		return RestoreAsset(dir, name)
	}
	// Dir
	for _, child := range children {
		err = RestoreAssets(dir, filepath.Join(name, child))
		if err != nil {
			return err
		}
	}
	return nil
}

func _filePath(dir, name string) string {
	cannonicalName := strings.Replace(name, "\\", "/", -1)
	return filepath.Join(append([]string{dir}, strings.Split(cannonicalName, "/")...)...)
}
