apiVersion: apps/v1
kind: Deployment
metadata:
  name: istiod-{{ .Values.revision | default "default" }}
  namespace: {{ .Release.Namespace }}
  labels:
    maistra-version: "2.1.0"
    app: istiod
    istio.io/rev: {{ .Values.revision | default "default" }}
    istio: pilot
    release: {{ .Release.Name }}
{{- range $key, $val := .Values.pilot.deploymentLabels }}
    {{ $key }}: "{{ $val }}"
{{- end }}
spec:
{{- if not .Values.pilot.autoscaleEnabled }}
{{- if .Values.pilot.replicaCount }}
  replicas: {{ .Values.pilot.replicaCount }}
{{- end }}
{{- end }}
  strategy:
    rollingUpdate:
      maxSurge: {{ .Values.pilot.rollingMaxSurge }}
      maxUnavailable: {{ .Values.pilot.rollingMaxUnavailable }}
  selector:
    matchLabels:
      app: istiod
      istio.io/rev: {{ .Values.revision | default "default" }}
  template:
    metadata:
      labels:
        maistra-control-plane: {{ .Release.Namespace }}
        app: istiod
        istio.io/rev: {{ .Values.revision | default "default" }}
        sidecar.istio.io/inject: "false"
        istio: istiod
        {{- if .Values.pilot.podLabels }}
{{ toYaml .Values.pilot.podLabels | indent 8 }}
        {{- end }}
      annotations:
        {{- if .Values.meshConfig.enablePrometheusMerge }}
        prometheus.io/port: "15014"
        prometheus.io/scrape: "true"
        {{- end }}
        sidecar.istio.io/inject: "false"
        {{- if .Values.pilot.podAnnotations }}
{{ toYaml .Values.pilot.podAnnotations | indent 8 }}
        {{- end }}
    spec:
      serviceAccountName: istiod-service-account-{{ .Values.revision | default "default" }}
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      containers:
        - name: discovery
          workingDir: "/"
{{- if contains "/" .Values.pilot.image }}
          image: "{{ .Values.pilot.image }}"
{{- else }}
          image: "{{ .Values.pilot.hub | default .Values.global.hub }}/{{ .Values.pilot.image | default "pilot" }}:{{ .Values.pilot.tag | default .Values.global.tag }}"
{{- end }}
{{- if .Values.global.imagePullPolicy }}
          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
{{- end }}
          args:
          - "discovery"
          - --memberRollName=default
          - --cacheCluster=outbound|80||wasm-cacher-{{ .Values.revision | default "default" }}.{{ .Release.Namespace }}.svc.cluster.local
          - --enableCRDScan=false
          - --enableIngressClassName=false
          - --disableNodeAccess=true
          - --monitoringAddr=:15014
{{- if .Values.global.logging.level }}
          - --log_output_level={{ .Values.global.logging.level }}
{{- end}}
{{- if .Values.global.logAsJson }}
          - --log_as_json
{{- end }}
          - --domain
          - {{ .Values.global.proxy.clusterDomain }}
{{- if .Values.global.oneNamespace }}
          - "-a"
          - {{ .Release.Namespace }}
{{- end }}
{{- if .Values.pilot.plugins }}
          - --plugins={{ .Values.pilot.plugins }}
{{- end }}
          - --keepaliveMaxServerConnectionAge
          - "{{ .Values.pilot.keepaliveMaxServerConnectionAge }}"
          ports:
          - containerPort: 8080
            protocol: TCP
          - containerPort: 15010
            protocol: TCP
          - name: webhook
            containerPort: 15017
            protocol: TCP
          - containerPort: 8188
            protocol: TCP
{{- if .Values.pilot.readiness }}
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: {{ .Values.pilot.readinessInitialDelaySeconds }}
            periodSeconds: {{ .Values.pilot.readinessPeriodSeconds }}
            timeoutSeconds: {{ .Values.pilot.readinessTimeoutSeconds }}
{{- end }}
          env:
          - name: ENABLE_MAISTRA_EXTENSIONS
            value: "{{ .Values.wasmExtensions.enabled }}"
{{- $iorEnabled := "true" }}
{{- $gateway := index .Values "gateways" "istio-ingressgateway" }}
{{- if or (not .Values.gateways.enabled) (not $gateway) (not $gateway.ior_enabled) }}
{{- $iorEnabled = "false" }}
{{- end }}
          - name: ENABLE_IOR
            value: "{{ $iorEnabled }}"
          - name: VALIDATION_WEBHOOK_CONFIG_NAME
            value: ""
          - name: INJECTION_WEBHOOK_CONFIG_NAME
            value: ""
          - name: REVISION
            value: "{{ .Values.revision | default `default` }}"
          - name: JWT_POLICY
            value: {{ .Values.global.jwtPolicy }}
          - name: PILOT_CERT_PROVIDER
            value: {{ .Values.global.pilotCertProvider }}
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: SERVICE_ACCOUNT
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: spec.serviceAccountName
          - name: KUBECONFIG
            value: /var/run/secrets/remote/config
          {{- if .Values.pilot.env }}
          {{- range $key, $val := .Values.pilot.env }}
          - name: {{ $key }}
            value: "{{ $val }}"
          {{- end }}
          {{- end }}
          - name: PILOT_ENABLE_FEDERATION
            value: "{{ .Values.pilot.enableFederation }}"
{{- if .Values.pilot.traceSampling }}
          - name: PILOT_TRACE_SAMPLING
            value: "{{ .Values.pilot.traceSampling }}"
{{- end }}
          - name: PILOT_ENABLE_PROTOCOL_SNIFFING_FOR_OUTBOUND
            value: "{{ .Values.pilot.enableProtocolSniffingForOutbound }}"
          - name: PILOT_ENABLE_PROTOCOL_SNIFFING_FOR_INBOUND
            value: "{{ .Values.pilot.enableProtocolSniffingForInbound }}"
          - name: ISTIOD_ADDR
            value: istiod-{{ .Values.revision | default "default" }}.{{ .Release.Namespace }}.svc:15012
          - name: PILOT_ENABLE_STATUS
            value: "{{ .Values.global.istiod.enableAnalysis }}"
          - name: PILOT_ENABLE_ANALYSIS
            value: "{{ .Values.global.istiod.enableAnalysis }}"
          - name: CLUSTER_ID
            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
          - name: EXTERNAL_ISTIOD
            value: "{{ $.Values.global.externalIstiod | default "false" }}"
{{- if .Values.global.tls }}
{{- if .Values.global.tls.minProtocolVersion }}
          - name: TLS_MIN_PROTOCOL_VERSION
            value: {{ .Values.global.tls.minProtocolVersion }}
{{- end }}
{{- if .Values.global.tls.maxProtocolVersion }}
          - name: TLS_MAX_PROTOCOL_VERSION
            value: {{ .Values.global.tls.maxProtocolVersion }}
{{- end }}
{{- if .Values.global.tls.cipherSuites }}
          - name: TLS_CIPHER_SUITES
            value: {{ .Values.global.tls.cipherSuites }}
{{- end }}
{{- if .Values.global.tls.ecdhCurves }}
          - name: TLS_ECDH_CURVES
            value: {{ .Values.global.tls.ecdhCurves }}
{{- end }}
{{- end }}
{{- if not .Values.telemetry.v2.enabled }}
          - name: PILOT_ENDPOINT_TELEMETRY_LABEL
            value: "false"
{{- end }}
          resources:
{{- if .Values.pilot.resources }}
{{ toYaml .Values.pilot.resources | trim | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
{{- end }}
          securityContext:
            capabilities:
              drop:
              - ALL
          volumeMounts:
          - name: config-volume
            mountPath: /etc/istio/config
          {{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
          - name: istio-token
            mountPath: /var/run/secrets/tokens
            readOnly: true
          {{- end }}
          - name: local-certs
            mountPath: /var/run/secrets/istio-dns
          - name: cacerts
            mountPath: /etc/cacerts
            readOnly: true
          - name: istio-kubeconfig
            mountPath: /var/run/secrets/remote
            readOnly: true
          - name: inject
            mountPath: /var/lib/istio/inject
            readOnly: true
          {{- if .Values.pilot.jwksResolverExtraRootCA }}
          - name: extracacerts
            mountPath: /cacerts
          {{- end }}
      affinity:
{{ include "nodeaffinity" (dict "global" .Values.global "nodeSelector" .Values.pilot.nodeSelector) }}
{{ include "podAntiAffinity" .Values.pilot }}
{{- if .Values.pilot.tolerations }}
      tolerations:
{{ toYaml .Values.pilot.tolerations | indent 6 }}
{{- else if .Values.global.defaultTolerations }}
      tolerations:
{{ toYaml .Values.global.defaultTolerations | indent 6 }}
{{- end }}
      volumes:
      # Technically not needed on this pod - but it helps debugging/testing SDS
      # Should be removed after everything works.
      - emptyDir:
          medium: Memory
        name: local-certs
      {{- if eq .Values.global.jwtPolicy "third-party-jwt" }}
      - name: istio-token
        projected:
          sources:
            - serviceAccountToken:
                audience: {{ .Values.global.sds.token.aud }}
                expirationSeconds: 43200
                path: istio-token
      {{- end }}
      # Optional: user-generated root
      - name: cacerts
        secret:
          secretName: cacerts
          optional: true
      - name: istio-kubeconfig
        secret:
          secretName: istio-kubeconfig
          optional: true
      # Optional - image should have
      - name: inject
        configMap:
          name: istio-sidecar-injector-{{ .Values.revision | default "default" }}
      - name: config-volume
        configMap:
          name: istio-{{ .Values.revision | default "default" }}
  {{- if .Values.pilot.jwksResolverExtraRootCA }}
      - name: extracacerts
        configMap:
          name: pilot-jwks-extra-cacerts-{{ .Values.revision | default "default" }}
  {{- end }}
---
