apiVersion: v1 items: - apiVersion: v1 kind: Pod metadata: annotations: container.apparmor.security.beta.kubernetes.io/install-cni: unconfined prometheus.io/path: /metrics prometheus.io/port: "15014" prometheus.io/scrape: "true" sidecar.istio.io/inject: "false" creationTimestamp: "2026-06-03T03:57:57Z" generateName: istio-cni-node- labels: app.kubernetes.io/instance: istio-cni app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 controller-revision-hash: "8588648495" helm.sh/chart: cni-1.27.9 istio.io/dataplane-mode: none k8s-app: istio-cni-node pod-template-generation: "1" sidecar.istio.io/inject: "false" name: istio-cni-node-tv9ll namespace: istio-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: DaemonSet name: istio-cni-node uid: a56c388d-8aeb-4cbb-b4e3-990f618d14a7 resourceVersion: "602" uid: 6b83c1f4-2639-4676-b5f1-65039bb5d71e spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchFields: - key: metadata.name operator: In values: - chart-test-swarm-run-14-control-plane containers: - args: - --log_output_level=info command: - install-cni env: - name: REPAIR_NODE_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: REPAIR_RUN_AS_DAEMON value: "true" - name: REPAIR_SIDECAR_ANNOTATION value: sidecar.istio.io/status - name: ALLOW_SWITCH_TO_HOST_NS value: "true" - name: NODE_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: GOMEMLIMIT valueFrom: resourceFieldRef: divisor: "1" resource: limits.memory - name: GOMAXPROCS valueFrom: resourceFieldRef: divisor: "1" resource: limits.cpu - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace envFrom: - configMapRef: name: istio-cni-config image: docker.io/istio/install-cni:1.27.9-distroless imagePullPolicy: IfNotPresent name: install-cni ports: - containerPort: 15014 name: metrics protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 8000 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 100m memory: 100Mi securityContext: appArmorProfile: type: Unconfined capabilities: add: - NET_ADMIN - NET_RAW - SYS_PTRACE - SYS_ADMIN - DAC_OVERRIDE drop: - ALL privileged: false runAsGroup: 0 runAsNonRoot: false runAsUser: 0 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /host/opt/cni/bin name: cni-bin-dir - mountPath: /host/proc name: cni-host-procfs readOnly: true - mountPath: /host/etc/cni/net.d name: cni-net-dir - mountPath: /var/run/istio-cni name: cni-socket-dir - mountPath: /host/var/run/netns mountPropagation: HostToContainer name: cni-netns-dir - mountPath: /var/run/ztunnel name: cni-ztunnel-sock-dir - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-54l6f readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-14-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 2000001000 priorityClassName: system-node-critical restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: istio-cni serviceAccountName: istio-cni terminationGracePeriodSeconds: 5 tolerations: - effect: NoSchedule operator: Exists - key: CriticalAddonsOnly operator: Exists - effect: NoExecute operator: Exists - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists - effect: NoSchedule key: node.kubernetes.io/disk-pressure operator: Exists - effect: NoSchedule key: node.kubernetes.io/memory-pressure operator: Exists - effect: NoSchedule key: node.kubernetes.io/pid-pressure operator: Exists - effect: NoSchedule key: node.kubernetes.io/unschedulable operator: Exists volumes: - hostPath: path: /opt/cni/bin type: "" name: cni-bin-dir - hostPath: path: /proc type: Directory name: cni-host-procfs - hostPath: path: /var/run/ztunnel type: DirectoryOrCreate name: cni-ztunnel-sock-dir - hostPath: path: /etc/cni/net.d type: "" name: cni-net-dir - hostPath: path: /var/run/istio-cni type: "" name: cni-socket-dir - hostPath: path: /var/run/netns type: DirectoryOrCreate name: cni-netns-dir - name: kube-api-access-54l6f projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-03T03:58:00Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-03T03:57:57Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-03T03:58:01Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-03T03:58:01Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-03T03:57:57Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://682d7b3df50bced9afda772da1044a7826e9df8b8e78b9a1f1282d8d73e2b48e image: docker.io/istio/install-cni:1.27.9-distroless imageID: docker.io/istio/install-cni@sha256:a4d628a76631860c13263589504d2410eff52e287428b78b37c709b1affa4f38 lastState: {} name: install-cni ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-03T03:57:59Z" hostIP: 172.20.0.3 hostIPs: - ip: 172.20.0.3 phase: Running podIP: 10.244.0.6 podIPs: - ip: 10.244.0.6 qosClass: Burstable startTime: "2026-06-03T03:57:57Z" - apiVersion: v1 kind: Pod metadata: annotations: prometheus.io/port: "15014" prometheus.io/scrape: "true" sidecar.istio.io/inject: "false" creationTimestamp: "2026-06-03T03:57:53Z" generateName: istiod-6876fc46d4- labels: app: istiod app.kubernetes.io/instance: istiod app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: istiod-1.27.9 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/dataplane-mode: none istio.io/rev: default operator.istio.io/component: Pilot pod-template-hash: 6876fc46d4 sidecar.istio.io/inject: "false" name: istiod-6876fc46d4-jv97s namespace: istio-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: istiod-6876fc46d4 uid: 8fc3a4b0-c493-4d28-8e0d-3e51cbe57fd8 resourceVersion: "565" uid: 47282e4e-e405-4bbd-8d28-c8273c080c8f spec: containers: - args: - discovery - --monitoringAddr=:15014 - --log_output_level=default:info - --domain - cluster.local - --keepaliveMaxServerConnectionAge - 30m env: - name: REVISION value: default - name: PILOT_CERT_PROVIDER value: istiod - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: SERVICE_ACCOUNT valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: KUBECONFIG value: /var/run/secrets/remote/config - name: CA_TRUSTED_NODE_ACCOUNTS value: istio-system/ztunnel - name: PILOT_ENABLE_AMBIENT value: "true" - name: PILOT_TRACE_SAMPLING value: "1" - name: PILOT_ENABLE_ANALYSIS value: "false" - name: CLUSTER_ID value: Kubernetes - name: GOMEMLIMIT valueFrom: resourceFieldRef: divisor: "1" resource: limits.memory - name: GOMAXPROCS valueFrom: resourceFieldRef: divisor: "1" resource: limits.cpu - name: PLATFORM image: docker.io/istio/pilot:1.27.9-distroless imagePullPolicy: IfNotPresent name: discovery ports: - containerPort: 8080 name: http-debug protocol: TCP - containerPort: 15010 name: grpc-xds protocol: TCP - containerPort: 15012 name: tls-xds protocol: TCP - containerPort: 15017 name: https-webhooks protocol: TCP - containerPort: 15014 name: http-monitoring protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 8080 scheme: HTTP initialDelaySeconds: 1 periodSeconds: 3 successThreshold: 1 timeoutSeconds: 5 resources: requests: cpu: 100m memory: 384Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/tokens name: istio-token readOnly: true - mountPath: /var/run/secrets/istio-dns name: local-certs - mountPath: /etc/cacerts name: cacerts readOnly: true - mountPath: /var/run/secrets/remote name: istio-kubeconfig readOnly: true - mountPath: /var/run/secrets/istiod/tls name: istio-csr-dns-cert readOnly: true - mountPath: /var/run/secrets/istiod/ca name: istio-csr-ca-configmap readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-jd6vp readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-14-control-plane preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: istiod serviceAccountName: istiod terminationGracePeriodSeconds: 30 tolerations: - key: cni.istio.io/not-ready operator: Exists - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - emptyDir: medium: Memory name: local-certs - name: istio-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: istio-ca expirationSeconds: 43200 path: istio-token - name: cacerts secret: defaultMode: 420 optional: true secretName: cacerts - name: istio-kubeconfig secret: defaultMode: 420 optional: true secretName: istio-kubeconfig - name: istio-csr-dns-cert secret: defaultMode: 420 optional: true secretName: istiod-tls - configMap: defaultMode: 420 name: istio-ca-root-cert optional: true name: istio-csr-ca-configmap - name: kube-api-access-jd6vp projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-03T03:57:56Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-03T03:57:53Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-03T03:57:56Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-03T03:57:56Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-03T03:57:53Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://f8b3678e0e9745c07cc6a6b84e2612557fed544d36238004d0917fcdb1ebeb30 image: docker.io/istio/pilot:1.27.9-distroless imageID: docker.io/istio/pilot@sha256:1bad79ad6dcc55912af10700552ed2fafd5117d78076f0751e6a15b61b17c547 lastState: {} name: discovery ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-03T03:57:55Z" hostIP: 172.20.0.3 hostIPs: - ip: 172.20.0.3 phase: Running podIP: 10.244.0.5 podIPs: - ip: 10.244.0.5 qosClass: Burstable startTime: "2026-06-03T03:57:53Z" - apiVersion: v1 kind: Pod metadata: annotations: prometheus.io/port: "15020" prometheus.io/scrape: "true" sidecar.istio.io/inject: "false" creationTimestamp: "2026-06-03T03:58:01Z" generateName: ztunnel- labels: app: ztunnel app.kubernetes.io/instance: ztunnel app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ztunnel app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 controller-revision-hash: c45f6d67 helm.sh/chart: ztunnel-1.27.9 istio.io/dataplane-mode: none pod-template-generation: "1" sidecar.istio.io/inject: "false" name: ztunnel-hktsd namespace: istio-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: DaemonSet name: ztunnel uid: cd3e907a-54c2-4e8f-85d4-f6ac7cba4429 resourceVersion: "633" uid: d413f2b8-5dce-4418-9756-288a5f7c7a00 spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchFields: - key: metadata.name operator: In values: - chart-test-swarm-run-14-control-plane containers: - args: - proxy - ztunnel env: - name: CA_ADDRESS value: istiod.istio-system.svc:15012 - name: XDS_ADDRESS value: istiod.istio-system.svc:15012 - name: RUST_LOG value: info - name: RUST_BACKTRACE value: "1" - name: ISTIO_META_CLUSTER_ID value: Kubernetes - name: INPOD_ENABLED value: "true" - name: TERMINATION_GRACE_PERIOD_SECONDS value: "30" - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: NODE_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: INSTANCE_IP valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIP - name: SERVICE_ACCOUNT valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: ZTUNNEL_CPU_LIMIT valueFrom: resourceFieldRef: divisor: "0" resource: limits.cpu image: docker.io/istio/ztunnel:1.27.9 imagePullPolicy: IfNotPresent name: istio-proxy ports: - containerPort: 15020 name: ztunnel-stats protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /healthz/ready port: 15021 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 200m memory: 512Mi securityContext: allowPrivilegeEscalation: true capabilities: add: - NET_ADMIN - SYS_ADMIN - NET_RAW drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 1337 runAsNonRoot: false runAsUser: 0 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/istio name: istiod-ca-cert - mountPath: /var/run/secrets/tokens name: istio-token - mountPath: /var/run/ztunnel name: cni-ztunnel-sock-dir - mountPath: /tmp name: tmp - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-dfghr readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-14-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 2000001000 priorityClassName: system-node-critical restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: ztunnel serviceAccountName: ztunnel terminationGracePeriodSeconds: 30 tolerations: - effect: NoSchedule operator: Exists - key: CriticalAddonsOnly operator: Exists - effect: NoExecute operator: Exists - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists - effect: NoSchedule key: node.kubernetes.io/disk-pressure operator: Exists - effect: NoSchedule key: node.kubernetes.io/memory-pressure operator: Exists - effect: NoSchedule key: node.kubernetes.io/pid-pressure operator: Exists - effect: NoSchedule key: node.kubernetes.io/unschedulable operator: Exists volumes: - name: istio-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: istio-ca expirationSeconds: 43200 path: istio-token - configMap: defaultMode: 420 name: istio-ca-root-cert name: istiod-ca-cert - hostPath: path: /var/run/ztunnel type: DirectoryOrCreate name: cni-ztunnel-sock-dir - emptyDir: {} name: tmp - name: kube-api-access-dfghr projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-03T03:58:05Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-03T03:58:01Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-03T03:58:05Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-03T03:58:05Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-03T03:58:01Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://05ba6163bc40ea67613934b064aef6276f63ef9b2942867eaf6b5e554fa2d8e0 image: docker.io/istio/ztunnel:1.27.9 imageID: docker.io/istio/ztunnel@sha256:4689289af635347b571c08cdec8be3d453bc4b33c7cb3b6542b4b9c960f85a4e lastState: {} name: istio-proxy ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-03T03:58:04Z" hostIP: 172.20.0.3 hostIPs: - ip: 172.20.0.3 phase: Running podIP: 10.244.0.7 podIPs: - ip: 10.244.0.7 qosClass: Burstable startTime: "2026-06-03T03:58:01Z" - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: istiod meta.helm.sh/release-namespace: istio-system creationTimestamp: "2026-06-03T03:57:53Z" labels: app: istiod app.kubernetes.io/instance: istiod app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: istiod-1.27.9 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/rev: default operator.istio.io/component: Pilot release: istiod name: istiod namespace: istio-system resourceVersion: "513" uid: b473fd9c-8668-40e3-acb3-d805d357de24 spec: clusterIP: 10.96.239.94 clusterIPs: - 10.96.239.94 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: grpc-xds port: 15010 protocol: TCP targetPort: 15010 - name: https-dns port: 15012 protocol: TCP targetPort: 15012 - name: https-webhook port: 443 protocol: TCP targetPort: 15017 - name: http-monitoring port: 15014 protocol: TCP targetPort: 15014 selector: app: istiod istio: pilot sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: apps/v1 kind: DaemonSet metadata: annotations: deprecated.daemonset.template.generation: "1" meta.helm.sh/release-name: istio-cni meta.helm.sh/release-namespace: istio-system creationTimestamp: "2026-06-03T03:57:57Z" generation: 1 labels: app.kubernetes.io/instance: istio-cni app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: cni-1.27.9 install.operator.istio.io/owning-resource: unknown istio.io/rev: default k8s-app: istio-cni-node operator.istio.io/component: Cni release: istio-cni name: istio-cni-node namespace: istio-system resourceVersion: "603" uid: a56c388d-8aeb-4cbb-b4e3-990f618d14a7 spec: revisionHistoryLimit: 10 selector: matchLabels: k8s-app: istio-cni-node template: metadata: annotations: container.apparmor.security.beta.kubernetes.io/install-cni: unconfined prometheus.io/path: /metrics prometheus.io/port: "15014" prometheus.io/scrape: "true" sidecar.istio.io/inject: "false" creationTimestamp: null labels: app.kubernetes.io/instance: istio-cni app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: cni-1.27.9 istio.io/dataplane-mode: none k8s-app: istio-cni-node sidecar.istio.io/inject: "false" spec: containers: - args: - --log_output_level=info command: - install-cni env: - name: REPAIR_NODE_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: REPAIR_RUN_AS_DAEMON value: "true" - name: REPAIR_SIDECAR_ANNOTATION value: sidecar.istio.io/status - name: ALLOW_SWITCH_TO_HOST_NS value: "true" - name: NODE_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: GOMEMLIMIT valueFrom: resourceFieldRef: divisor: "1" resource: limits.memory - name: GOMAXPROCS valueFrom: resourceFieldRef: divisor: "1" resource: limits.cpu - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace envFrom: - configMapRef: name: istio-cni-config image: docker.io/istio/install-cni:1.27.9-distroless imagePullPolicy: IfNotPresent name: install-cni ports: - containerPort: 15014 name: metrics protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 8000 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 100m memory: 100Mi securityContext: capabilities: add: - NET_ADMIN - NET_RAW - SYS_PTRACE - SYS_ADMIN - DAC_OVERRIDE drop: - ALL privileged: false runAsGroup: 0 runAsNonRoot: false runAsUser: 0 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /host/opt/cni/bin name: cni-bin-dir - mountPath: /host/proc name: cni-host-procfs readOnly: true - mountPath: /host/etc/cni/net.d name: cni-net-dir - mountPath: /var/run/istio-cni name: cni-socket-dir - mountPath: /host/var/run/netns mountPropagation: HostToContainer name: cni-netns-dir - mountPath: /var/run/ztunnel name: cni-ztunnel-sock-dir dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux priorityClassName: system-node-critical restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: istio-cni serviceAccountName: istio-cni terminationGracePeriodSeconds: 5 tolerations: - effect: NoSchedule operator: Exists - key: CriticalAddonsOnly operator: Exists - effect: NoExecute operator: Exists volumes: - hostPath: path: /opt/cni/bin type: "" name: cni-bin-dir - hostPath: path: /proc type: Directory name: cni-host-procfs - hostPath: path: /var/run/ztunnel type: DirectoryOrCreate name: cni-ztunnel-sock-dir - hostPath: path: /etc/cni/net.d type: "" name: cni-net-dir - hostPath: path: /var/run/istio-cni type: "" name: cni-socket-dir - hostPath: path: /var/run/netns type: DirectoryOrCreate name: cni-netns-dir updateStrategy: rollingUpdate: maxSurge: 0 maxUnavailable: 1 type: RollingUpdate status: currentNumberScheduled: 1 desiredNumberScheduled: 1 numberAvailable: 1 numberMisscheduled: 0 numberReady: 1 observedGeneration: 1 updatedNumberScheduled: 1 - apiVersion: apps/v1 kind: DaemonSet metadata: annotations: deprecated.daemonset.template.generation: "1" meta.helm.sh/release-name: ztunnel meta.helm.sh/release-namespace: istio-system creationTimestamp: "2026-06-03T03:58:01Z" generation: 1 labels: app.kubernetes.io/instance: ztunnel app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ztunnel app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: ztunnel-1.27.9 name: ztunnel namespace: istio-system resourceVersion: "634" uid: cd3e907a-54c2-4e8f-85d4-f6ac7cba4429 spec: revisionHistoryLimit: 10 selector: matchLabels: app: ztunnel template: metadata: annotations: prometheus.io/port: "15020" prometheus.io/scrape: "true" sidecar.istio.io/inject: "false" creationTimestamp: null labels: app: ztunnel app.kubernetes.io/instance: ztunnel app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ztunnel app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: ztunnel-1.27.9 istio.io/dataplane-mode: none sidecar.istio.io/inject: "false" spec: containers: - args: - proxy - ztunnel env: - name: CA_ADDRESS value: istiod.istio-system.svc:15012 - name: XDS_ADDRESS value: istiod.istio-system.svc:15012 - name: RUST_LOG value: info - name: RUST_BACKTRACE value: "1" - name: ISTIO_META_CLUSTER_ID value: Kubernetes - name: INPOD_ENABLED value: "true" - name: TERMINATION_GRACE_PERIOD_SECONDS value: "30" - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: NODE_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: INSTANCE_IP valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIP - name: SERVICE_ACCOUNT valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: ZTUNNEL_CPU_LIMIT valueFrom: resourceFieldRef: divisor: "0" resource: limits.cpu image: docker.io/istio/ztunnel:1.27.9 imagePullPolicy: IfNotPresent name: istio-proxy ports: - containerPort: 15020 name: ztunnel-stats protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /healthz/ready port: 15021 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 200m memory: 512Mi securityContext: allowPrivilegeEscalation: true capabilities: add: - NET_ADMIN - SYS_ADMIN - NET_RAW drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 1337 runAsNonRoot: false runAsUser: 0 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/istio name: istiod-ca-cert - mountPath: /var/run/secrets/tokens name: istio-token - mountPath: /var/run/ztunnel name: cni-ztunnel-sock-dir - mountPath: /tmp name: tmp dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux priorityClassName: system-node-critical restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: ztunnel serviceAccountName: ztunnel terminationGracePeriodSeconds: 30 tolerations: - effect: NoSchedule operator: Exists - key: CriticalAddonsOnly operator: Exists - effect: NoExecute operator: Exists volumes: - name: istio-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: istio-ca expirationSeconds: 43200 path: istio-token - configMap: defaultMode: 420 name: istio-ca-root-cert name: istiod-ca-cert - hostPath: path: /var/run/ztunnel type: DirectoryOrCreate name: cni-ztunnel-sock-dir - emptyDir: {} name: tmp updateStrategy: rollingUpdate: maxSurge: 1 maxUnavailable: 0 type: RollingUpdate status: currentNumberScheduled: 1 desiredNumberScheduled: 1 numberAvailable: 1 numberMisscheduled: 0 numberReady: 1 observedGeneration: 1 updatedNumberScheduled: 1 - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: istiod meta.helm.sh/release-namespace: istio-system creationTimestamp: "2026-06-03T03:57:53Z" generation: 1 labels: app: istiod app.kubernetes.io/instance: istiod app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: istiod-1.27.9 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/rev: default operator.istio.io/component: Pilot release: istiod name: istiod namespace: istio-system resourceVersion: "570" uid: 36fe7112-275d-4751-819f-f8a354529d80 spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: istio: pilot strategy: rollingUpdate: maxSurge: 100% maxUnavailable: 25% type: RollingUpdate template: metadata: annotations: prometheus.io/port: "15014" prometheus.io/scrape: "true" sidecar.istio.io/inject: "false" creationTimestamp: null labels: app: istiod app.kubernetes.io/instance: istiod app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: istiod-1.27.9 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/dataplane-mode: none istio.io/rev: default operator.istio.io/component: Pilot sidecar.istio.io/inject: "false" spec: containers: - args: - discovery - --monitoringAddr=:15014 - --log_output_level=default:info - --domain - cluster.local - --keepaliveMaxServerConnectionAge - 30m env: - name: REVISION value: default - name: PILOT_CERT_PROVIDER value: istiod - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: SERVICE_ACCOUNT valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: KUBECONFIG value: /var/run/secrets/remote/config - name: CA_TRUSTED_NODE_ACCOUNTS value: istio-system/ztunnel - name: PILOT_ENABLE_AMBIENT value: "true" - name: PILOT_TRACE_SAMPLING value: "1" - name: PILOT_ENABLE_ANALYSIS value: "false" - name: CLUSTER_ID value: Kubernetes - name: GOMEMLIMIT valueFrom: resourceFieldRef: divisor: "1" resource: limits.memory - name: GOMAXPROCS valueFrom: resourceFieldRef: divisor: "1" resource: limits.cpu - name: PLATFORM image: docker.io/istio/pilot:1.27.9-distroless imagePullPolicy: IfNotPresent name: discovery ports: - containerPort: 8080 name: http-debug protocol: TCP - containerPort: 15010 name: grpc-xds protocol: TCP - containerPort: 15012 name: tls-xds protocol: TCP - containerPort: 15017 name: https-webhooks protocol: TCP - containerPort: 15014 name: http-monitoring protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 8080 scheme: HTTP initialDelaySeconds: 1 periodSeconds: 3 successThreshold: 1 timeoutSeconds: 5 resources: requests: cpu: 100m memory: 384Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/tokens name: istio-token readOnly: true - mountPath: /var/run/secrets/istio-dns name: local-certs - mountPath: /etc/cacerts name: cacerts readOnly: true - mountPath: /var/run/secrets/remote name: istio-kubeconfig readOnly: true - mountPath: /var/run/secrets/istiod/tls name: istio-csr-dns-cert readOnly: true - mountPath: /var/run/secrets/istiod/ca name: istio-csr-ca-configmap readOnly: true dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: istiod serviceAccountName: istiod terminationGracePeriodSeconds: 30 tolerations: - key: cni.istio.io/not-ready operator: Exists volumes: - emptyDir: medium: Memory name: local-certs - name: istio-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: istio-ca expirationSeconds: 43200 path: istio-token - name: cacerts secret: defaultMode: 420 optional: true secretName: cacerts - name: istio-kubeconfig secret: defaultMode: 420 optional: true secretName: istio-kubeconfig - name: istio-csr-dns-cert secret: defaultMode: 420 optional: true secretName: istiod-tls - configMap: defaultMode: 420 name: istio-ca-root-cert optional: true name: istio-csr-ca-configmap status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-03T03:57:57Z" lastUpdateTime: "2026-06-03T03:57:57Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-03T03:57:53Z" lastUpdateTime: "2026-06-03T03:57:57Z" message: ReplicaSet "istiod-6876fc46d4" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: istiod meta.helm.sh/release-namespace: istio-system creationTimestamp: "2026-06-03T03:57:53Z" generation: 1 labels: app: istiod app.kubernetes.io/instance: istiod app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: istiod-1.27.9 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/dataplane-mode: none istio.io/rev: default operator.istio.io/component: Pilot pod-template-hash: 6876fc46d4 sidecar.istio.io/inject: "false" name: istiod-6876fc46d4 namespace: istio-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: istiod uid: 36fe7112-275d-4751-819f-f8a354529d80 resourceVersion: "569" uid: 8fc3a4b0-c493-4d28-8e0d-3e51cbe57fd8 spec: replicas: 1 selector: matchLabels: istio: pilot pod-template-hash: 6876fc46d4 template: metadata: annotations: prometheus.io/port: "15014" prometheus.io/scrape: "true" sidecar.istio.io/inject: "false" creationTimestamp: null labels: app: istiod app.kubernetes.io/instance: istiod app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: istiod-1.27.9 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/dataplane-mode: none istio.io/rev: default operator.istio.io/component: Pilot pod-template-hash: 6876fc46d4 sidecar.istio.io/inject: "false" spec: containers: - args: - discovery - --monitoringAddr=:15014 - --log_output_level=default:info - --domain - cluster.local - --keepaliveMaxServerConnectionAge - 30m env: - name: REVISION value: default - name: PILOT_CERT_PROVIDER value: istiod - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: SERVICE_ACCOUNT valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: KUBECONFIG value: /var/run/secrets/remote/config - name: CA_TRUSTED_NODE_ACCOUNTS value: istio-system/ztunnel - name: PILOT_ENABLE_AMBIENT value: "true" - name: PILOT_TRACE_SAMPLING value: "1" - name: PILOT_ENABLE_ANALYSIS value: "false" - name: CLUSTER_ID value: Kubernetes - name: GOMEMLIMIT valueFrom: resourceFieldRef: divisor: "1" resource: limits.memory - name: GOMAXPROCS valueFrom: resourceFieldRef: divisor: "1" resource: limits.cpu - name: PLATFORM image: docker.io/istio/pilot:1.27.9-distroless imagePullPolicy: IfNotPresent name: discovery ports: - containerPort: 8080 name: http-debug protocol: TCP - containerPort: 15010 name: grpc-xds protocol: TCP - containerPort: 15012 name: tls-xds protocol: TCP - containerPort: 15017 name: https-webhooks protocol: TCP - containerPort: 15014 name: http-monitoring protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 8080 scheme: HTTP initialDelaySeconds: 1 periodSeconds: 3 successThreshold: 1 timeoutSeconds: 5 resources: requests: cpu: 100m memory: 384Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/tokens name: istio-token readOnly: true - mountPath: /var/run/secrets/istio-dns name: local-certs - mountPath: /etc/cacerts name: cacerts readOnly: true - mountPath: /var/run/secrets/remote name: istio-kubeconfig readOnly: true - mountPath: /var/run/secrets/istiod/tls name: istio-csr-dns-cert readOnly: true - mountPath: /var/run/secrets/istiod/ca name: istio-csr-ca-configmap readOnly: true dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: istiod serviceAccountName: istiod terminationGracePeriodSeconds: 30 tolerations: - key: cni.istio.io/not-ready operator: Exists volumes: - emptyDir: medium: Memory name: local-certs - name: istio-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: istio-ca expirationSeconds: 43200 path: istio-token - name: cacerts secret: defaultMode: 420 optional: true secretName: cacerts - name: istio-kubeconfig secret: defaultMode: 420 optional: true secretName: istio-kubeconfig - name: istio-csr-dns-cert secret: defaultMode: 420 optional: true secretName: istiod-tls - configMap: defaultMode: 420 name: istio-ca-root-cert optional: true name: istio-csr-ca-configmap status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 - apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: annotations: meta.helm.sh/release-name: istiod meta.helm.sh/release-namespace: istio-system creationTimestamp: "2026-06-03T03:57:53Z" labels: app: istiod app.kubernetes.io/instance: istiod app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: istiod-1.27.9 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Pilot release: istiod name: istiod namespace: istio-system resourceVersion: "678" uid: e8cd6c63-3942-49a5-9118-7ffe063dab68 spec: maxReplicas: 5 metrics: - resource: name: cpu target: averageUtilization: 80 type: Utilization type: Resource minReplicas: 1 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: istiod status: conditions: - lastTransitionTime: "2026-06-03T03:58:08Z" message: the HPA controller was able to get the target's current scale reason: SucceededGetScale status: "True" type: AbleToScale - lastTransitionTime: "2026-06-03T03:58:08Z" message: 'the HPA was unable to compute the replica count: failed to get cpu utilization: unable to get metrics for resource cpu: unable to fetch metrics from resource metrics API: the server could not find the requested resource (get pods.metrics.k8s.io)' reason: FailedGetResourceMetric status: "False" type: ScalingActive currentMetrics: - type: "" currentReplicas: 1 desiredReplicas: 0 kind: List metadata: resourceVersion: ""