{{- if not .Values.global.omitSidecarInjectorConfigMap }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-sidecar-injector
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ template "istio.name" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    istio: sidecar-injector
data:
  config: |-
    policy: {{ .Values.global.proxy.autoInject }}
    template: |-
      initContainers:
      - name: istio-init
{{- if contains "/" .Values.global.proxy_init.image }}
        image: "{{ .Values.global.proxy_init.image }}"
{{- else }}
        image: "{{ .Values.global.hub }}/{{ .Values.global.proxy_init.image }}:{{ .Values.global.tag }}"
{{- end }}
        args:
        - "-p"
        - {{ "[[ .MeshConfig.ProxyListenPort ]]" }}
        - "-u"
        - 1337
        - "-m"
        - {{ "[[ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode ]]" }}
        - "-i"
        - {{ "\"[[ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` " }} "{{ .Values.global.proxy.includeIPRanges }}" {{ " ]]\"" }}
        - "-x"
        - {{ "\"[[ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` " }} "{{ .Values.global.proxy.excludeIPRanges }}" {{ " ]]\"" }}
        - "-b"
        - {{ "\"[[ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` (includeInboundPorts .Spec.Containers) ]]\"" }}
        - "-d"
        - {{ "\"[[ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` " }} {{ .Values.global.proxy.statusPort }} {{ ") (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` " }} "{{ .Values.global.proxy.excludeInboundPorts }}" {{ ") ]]\"" }}
        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
        securityContext:
          capabilities:
            add:
            - NET_ADMIN
          privileged: true
        restartPolicy: Always
      {{- if .Values.global.proxy.enableCoreDump }}
      - args:
        - -c
        - sysctl -w kernel.core_pattern=/var/lib/istio/core.proxy && ulimit -c unlimited
        command:
          - /bin/sh
        image: {{ .Values.global.hub }}/proxy_init:{{ .Values.global.tag }}
        imagePullPolicy: IfNotPresent
        name: enable-core-dump
        resources: {}
        securityContext:
          privileged: true
      {{ end }}
      containers:
      - name: istio-proxy
{{- if contains "/" .Values.global.proxy.image }}
        image: {{ "[[ annotation .ObjectMeta `sidecar.istio.io/proxyImage` " }} "{{ .Values.global.proxy.image }}" {{ " ]]" }}
{{- else }}
        image: {{ "[[ annotation .ObjectMeta `sidecar.istio.io/proxyImage` " }} "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}" {{ " ]]" }}
{{- end }}
{{ if ne .Values.global.proxy.stats.prometheusPort 0. }}
        ports:
        - containerPort: {{ .Values.global.proxy.stats.prometheusPort }}
          protocol: TCP
          name: http-envoy-prom
{{ end }}
        args:
        - proxy
        - sidecar
        - --configPath
        - {{ "[[ .ProxyConfig.ConfigPath ]]" }}
        - --binaryPath
        - {{ "[[ .ProxyConfig.BinaryPath ]]" }}
        - --serviceCluster
        {{ "[[ if ne \"\" (index .ObjectMeta.Labels \"app\") -]]" }}
        - {{ "[[ index .ObjectMeta.Labels \"app\" ]]" }}
        {{ "[[ else -]]" }}
        - "istio-proxy"
        {{ "[[ end -]]" }}
        - --drainDuration
        - {{ "[[ formatDuration .ProxyConfig.DrainDuration ]]" }}
        - --parentShutdownDuration
        - {{ "[[ formatDuration .ProxyConfig.ParentShutdownDuration ]]" }}
        - --discoveryAddress
        - {{ "[[ annotation .ObjectMeta `sidecar.istio.io/discoveryAddress` .ProxyConfig.DiscoveryAddress ]]" }}
        - --discoveryRefreshDelay
        - {{ "[[ formatDuration .ProxyConfig.DiscoveryRefreshDelay ]]" }}
        - --zipkinAddress
        - {{ "[[ .ProxyConfig.ZipkinAddress ]]" }}
        - --connectTimeout
        - {{ "[[ formatDuration .ProxyConfig.ConnectTimeout ]]" }}
      {{- if .Values.global.proxy.envoyStatsd.enabled }}
        - --statsdUdpAddress
        - {{ "[[ .ProxyConfig.StatsdUdpAddress ]]" }}
      {{- end }}
        - --proxyAdminPort
        - {{ "[[ .ProxyConfig.ProxyAdminPort ]]" }}
        {{ "[[ if gt .ProxyConfig.Concurrency 0 -]]" }}
        - --concurrency
        - {{ "[[ .ProxyConfig.Concurrency ]]" }}
        {{ "[[ end -]]" }}
        - --controlPlaneAuthPolicy
        - {{ "[[ annotation .ObjectMeta `sidecar.istio.io/controlPlaneAuthPolicy` .ProxyConfig.ControlPlaneAuthPolicy ]]" }}
      {{ "[[- if (ne (annotation .ObjectMeta `status.sidecar.istio.io/port` " }} {{ .Values.global.proxy.statusPort }} {{ ") \"0\") ]]" }}
        - --statusPort
        - {{ "[[ annotation .ObjectMeta `status.sidecar.istio.io/port` " }} {{ .Values.global.proxy.statusPort }} {{ " ]]" }}
        - --applicationPorts
        - {{ "\"[[ annotation .ObjectMeta `readiness.status.sidecar.istio.io/applicationPorts` (applicationPorts .Spec.Containers) ]]\"" }}
      {{ "[[- end ]]" }}
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: ISTIO_META_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: ISTIO_META_INTERCEPTION_MODE
          value: {{ "[[ or (index .ObjectMeta.Annotations \"sidecar.istio.io/interceptionMode\") .ProxyConfig.InterceptionMode.String ]]" }}
        {{ "[[ if .ObjectMeta.Annotations ]]" }}
        - name: ISTIO_METAJSON_ANNOTATIONS
          value: |
                 {{ "[[ toJson .ObjectMeta.Annotations ]]" }}
        {{ "[[ end ]]" }}
        {{ "[[ if .ObjectMeta.Labels ]]" }}
        - name: ISTIO_METAJSON_LABELS
          value: |
                 {{ "[[ toJson .ObjectMeta.Labels ]]" }}
        {{ "[[ end ]]" }}
        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
        {{ "[[ if (ne (annotation .ObjectMeta `status.sidecar.istio.io/port` " }} {{ .Values.global.proxy.statusPort }} {{ ") \"0\") ]]" }}
        readinessProbe:
          httpGet:
            path: /healthz/ready
            port: {{ "[[ annotation .ObjectMeta `status.sidecar.istio.io/port` " }} {{ .Values.global.proxy.statusPort }} {{ " ]]" }}
          initialDelaySeconds: {{ "[[ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` " }} {{ .Values.global.proxy.readinessInitialDelaySeconds }} {{ " ]]" }}
          periodSeconds: {{ "[[ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` " }} {{ .Values.global.proxy.readinessPeriodSeconds }} {{ " ]]" }}
          failureThreshold: {{ "[[ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` " }} {{ .Values.global.proxy.readinessFailureThreshold }} {{ " ]]" }}
        {{ "[[ end -]]" -}}
        securityContext:
          {{ if .Values.global.proxy.privileged }}
          privileged: true
          {{ end -}}
          {{- if ne .Values.global.proxy.enableCoreDump true }}
          readOnlyRootFilesystem: true
          {{- end }}
          {{ "[[ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) \"TPROXY\" -]]" }}
          capabilities:
            add:
            - NET_ADMIN
          runAsGroup: 1337
          {{ "[[ else -]]" }}
          runAsUser: 1337
          {{ "[[ end -]]" }}
        restartPolicy: Always
        resources:
          {{ "[[ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -]]" }}
          requests:
            cpu: {{ "\"[[ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` ]]\"" }}
            memory: {{ "\"[[ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` ]]\"" }}
        {{ "[[ else -]]" }}
{{- if .Values.global.proxy.resources }}
{{ toYaml .Values.global.proxy.resources | indent 10 }}
{{- end }}
        {{ "[[ end -]]" }}
        volumeMounts:
        - mountPath: /etc/istio/proxy
          name: istio-envoy
        - mountPath: /etc/certs/
          name: istio-certs
          readOnly: true
      volumes:
      - emptyDir:
          medium: Memory
        name: istio-envoy
      - name: istio-certs
        secret:
          optional: true
          {{ "[[ if eq .Spec.ServiceAccountName \"\" -]]" }}
          secretName: istio.default
          {{ "[[ else -]]" }}
          secretName: {{ "[[ printf \"istio.%s\" .Spec.ServiceAccountName ]]"  }}
          {{ "[[ end -]]" }}
{{- end }}
