{{- if not .Values.global.omitSidecarInjectorConfigMap }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-sidecar-injector
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ template "istio.name" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    istio: sidecar-injector
data:
  config: |-
    policy: {{ .Values.global.proxy.autoInject }}
    template: |-
      initContainers:
      - name: istio-init
{{- if contains "/" .Values.global.proxy_init.image }}
        image: "{{ .Values.global.proxy_init.image }}"
{{- else }}
        image: "{{ .Values.global.hub }}/{{ .Values.global.proxy_init.image }}:{{ .Values.global.tag }}"
{{- end }}
        args:
        - "-p"
        - {{ "[[ .MeshConfig.ProxyListenPort ]]" }}
        - "-u"
        - 1337
        - "-m"
        - {{ "[[ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode ]]" }}
        - "-i"
        - {{ "\"[[ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` " }} "{{ .Values.global.proxy.includeIPRanges }}" {{ " ]]\"" }}
        - "-x"
        - {{ "\"[[ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` " }} "{{ .Values.global.proxy.excludeIPRanges }}" {{ " ]]\"" }}
        - "-b"
        - {{ "\"[[ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` (includeInboundPorts .Spec.Containers) ]]\"" }}
        - "-d"
        - {{ "\"[[ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` " }} "{{ .Values.global.proxy.excludeInboundPorts }}" {{ " ]]\"" }}
        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
        securityContext:
          capabilities:
            add:
            - NET_ADMIN
          privileged: true
        restartPolicy: Always
      {{ if eq .Values.global.proxy.enableCoreDump true }}
      - args:
        - -c
        - sysctl -w kernel.core_pattern=/etc/istio/proxy/core.%e.%p.%t && ulimit -c unlimited
        command:
          - /bin/sh
        image: {{ .Values.global.hub }}/proxy_init:{{ .Values.global.tag }}
        imagePullPolicy: IfNotPresent
        name: enable-core-dump
        resources: {}
        securityContext:
          privileged: true
      {{ end }}
      containers:
      - name: istio-proxy
        image: {{ "[[ annotation .ObjectMeta `sidecar.istio.io/proxyImage` " }} "{{ .Values.global.hub }}/{{ .Values.global.proxy.image }}:{{ .Values.global.tag }}" {{ " ]]" }}
        args:
        - proxy
        - sidecar
        - --configPath
        - {{ "[[ .ProxyConfig.ConfigPath ]]" }}
        - --binaryPath
        - {{ "[[ .ProxyConfig.BinaryPath ]]" }}
        - --serviceCluster
        {{ "[[ if ne \"\" (index .ObjectMeta.Labels \"app\") -]]" }}
        - {{ "[[ index .ObjectMeta.Labels \"app\" ]]" }}
        {{ "[[ else -]]" }}
        - "istio-proxy"
        {{ "[[ end -]]" }}
        - --drainDuration
        - {{ "[[ formatDuration .ProxyConfig.DrainDuration ]]" }}
        - --parentShutdownDuration
        - {{ "[[ formatDuration .ProxyConfig.ParentShutdownDuration ]]" }}
        - --discoveryAddress
        - {{ "[[ .ProxyConfig.DiscoveryAddress ]]" }}
        - --discoveryRefreshDelay
        - {{ "[[ formatDuration .ProxyConfig.DiscoveryRefreshDelay ]]" }}
        - --zipkinAddress
        - {{ "[[ .ProxyConfig.ZipkinAddress ]]" }}
        - --connectTimeout
        - {{ "[[ formatDuration .ProxyConfig.ConnectTimeout ]]" }}
      {{- if .Values.global.proxy.envoyStatsd.enabled }}
        - --statsdUdpAddress
        - {{ "[[ .ProxyConfig.StatsdUdpAddress ]]" }}
      {{- end }}
        - --proxyAdminPort
        - {{ "[[ .ProxyConfig.ProxyAdminPort ]]" }}
        - --controlPlaneAuthPolicy
        - {{ "[[ annotation .ObjectMeta `sidecar.istio.io/controlPlaneAuthPolicy` .ProxyConfig.ControlPlaneAuthPolicy ]]" }}
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: ISTIO_META_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: ISTIO_META_INTERCEPTION_MODE
          value: {{ "[[ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode ]]" }}
        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
        securityContext:
          privileged: false
          readOnlyRootFilesystem: true
          {{ "[[ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) \"TPROXY\" -]]" }}
          capabilities:
            add:
            - NET_ADMIN
          runAsGroup: 1337
          {{ "[[ else -]]" }}
          runAsUser: 1337
          {{ "[[ end -]]" }}
        restartPolicy: Always
        resources:
          {{ "[[ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -]]" }}
          requests:
            cpu: {{ "\"[[ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` ]]\"" }}
            memory: {{ "\"[[ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` ]]\"" }}
        {{ "[[ else -]]" }}
{{- if .Values.global.proxy.resources }}
{{ toYaml .Values.global.proxy.resources | indent 10 }}
{{- end }}
        {{ "[[ end -]]" }}
        volumeMounts:
        - mountPath: /etc/istio/proxy
          name: istio-envoy
        - mountPath: /etc/certs/
          name: istio-certs
          readOnly: true
      volumes:
      - emptyDir:
          medium: Memory
        name: istio-envoy
      - name: istio-certs
        secret:
          optional: true
          {{ "[[ if eq .Spec.ServiceAccountName \"\" -]]" }}
          secretName: istio.default
          {{ "[[ else -]]" }}
          secretName: {{ "[[ printf \"istio.%s\" .Spec.ServiceAccountName ]]"  }}
          {{ "[[ end -]]" }}
{{- end }}
