apiVersion: v1 items: - apiVersion: v1 kind: Pod metadata: annotations: inject.istio.io/templates: gateway istio.io/rev: default prometheus.io/path: /stats/prometheus prometheus.io/port: "15020" prometheus.io/scrape: "true" proxy.istio.io/overrides: '{"containers":[{"name":"istio-proxy","ports":[{"name":"http-envoy-prom","containerPort":15090,"protocol":"TCP"}],"resources":{"limits":{"cpu":"2","memory":"1Gi"},"requests":{"cpu":"100m","memory":"128Mi"}},"volumeMounts":[{"name":"kube-api-access-s9lff","readOnly":true,"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount"}],"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"Always","securityContext":{"capabilities":{"drop":["ALL"]},"privileged":false,"runAsUser":1337,"runAsGroup":1337,"runAsNonRoot":true,"readOnlyRootFilesystem":true,"allowPrivilegeEscalation":false}}]}' sidecar.istio.io/inject: "true" sidecar.istio.io/status: '{"initContainers":null,"containers":["istio-proxy"],"volumes":["workload-socket","credential-socket","workload-certs","istio-envoy","istio-data","istio-podinfo","istio-token","istiod-ca-cert"],"imagePullSecrets":null,"revision":"default"}' creationTimestamp: "2026-06-03T03:59:18Z" generateName: istio-ingressgateway-8584b67974- labels: app: istio-ingressgateway app.kubernetes.io/instance: istio-ingressgateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: gateway-1.27.9 istio: ingressgateway istio.io/dataplane-mode: none pod-template-hash: 8584b67974 service.istio.io/canonical-name: istio-ingressgateway service.istio.io/canonical-revision: 1.27.9 sidecar.istio.io/inject: "true" name: istio-ingressgateway-8584b67974-67rxn namespace: istio-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: istio-ingressgateway-8584b67974 uid: 39a3635e-6306-427a-91d6-8fb0f4405f7c resourceVersion: "617" uid: 74245eab-81db-4385-9d6e-412c83cd1ff7 spec: containers: - args: - proxy - router - --domain - $(POD_NAMESPACE).svc.cluster.local - --proxyLogLevel=warning - --proxyComponentLogLevel=misc:error - --log_output_level=default:info env: - name: PILOT_CERT_PROVIDER value: istiod - name: CA_ADDR value: istiod.istio-system.svc:15012 - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: INSTANCE_IP valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIP - name: SERVICE_ACCOUNT valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: HOST_IP valueFrom: fieldRef: apiVersion: v1 fieldPath: status.hostIP - name: ISTIO_CPU_LIMIT valueFrom: resourceFieldRef: divisor: "0" resource: limits.cpu - name: PROXY_CONFIG value: | {} - name: ISTIO_META_POD_PORTS value: |- [ {"name":"http-envoy-prom","containerPort":15090,"protocol":"TCP"} ] - name: GOMEMLIMIT valueFrom: resourceFieldRef: divisor: "0" resource: limits.memory - name: GOMAXPROCS valueFrom: resourceFieldRef: divisor: "0" resource: limits.cpu - name: ISTIO_META_APP_CONTAINERS - name: ISTIO_META_CLUSTER_ID value: Kubernetes - name: ISTIO_META_NODE_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: ISTIO_META_INTERCEPTION_MODE value: REDIRECT - name: ISTIO_META_WORKLOAD_NAME value: istio-ingressgateway - name: ISTIO_META_OWNER value: kubernetes://apis/apps/v1/namespaces/istio-system/deployments/istio-ingressgateway - name: ISTIO_META_MESH_ID value: cluster.local - name: TRUST_DOMAIN value: cluster.local image: docker.io/istio/proxyv2:1.27.9 imagePullPolicy: Always name: istio-proxy ports: - containerPort: 15090 name: http-envoy-prom protocol: TCP readinessProbe: failureThreshold: 4 httpGet: path: /healthz/ready port: 15021 scheme: HTTP periodSeconds: 15 successThreshold: 1 timeoutSeconds: 3 resources: limits: cpu: "2" memory: 1Gi requests: cpu: 100m memory: 128Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 1337 runAsNonRoot: true runAsUser: 1337 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/workload-spiffe-uds name: workload-socket - mountPath: /var/run/secrets/credential-uds name: credential-socket - mountPath: /var/run/secrets/workload-spiffe-credentials name: workload-certs - mountPath: /var/run/secrets/istio name: istiod-ca-cert - mountPath: /var/lib/istio/data name: istio-data - mountPath: /etc/istio/proxy name: istio-envoy - mountPath: /var/run/secrets/tokens name: istio-token - mountPath: /etc/istio/pod name: istio-podinfo - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-s9lff readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-15-control-plane preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: sysctls: - name: net.ipv4.ip_unprivileged_port_start value: "0" serviceAccount: istio-ingressgateway serviceAccountName: istio-ingressgateway terminationGracePeriodSeconds: 30 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - emptyDir: {} name: workload-socket - emptyDir: {} name: credential-socket - emptyDir: {} name: workload-certs - emptyDir: medium: Memory name: istio-envoy - emptyDir: {} name: istio-data - downwardAPI: defaultMode: 420 items: - fieldRef: apiVersion: v1 fieldPath: metadata.labels path: labels - fieldRef: apiVersion: v1 fieldPath: metadata.annotations path: annotations name: istio-podinfo - name: istio-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: istio-ca expirationSeconds: 43200 path: istio-token - configMap: defaultMode: 420 name: istio-ca-root-cert name: istiod-ca-cert - name: kube-api-access-s9lff projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-03T03:59:22Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-03T03:59:18Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-03T03:59:22Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-03T03:59:22Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-03T03:59:18Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://87ce63c645ac75da1cee097e86eccf772f472b7257f6bc1d49163d579008444b image: docker.io/istio/proxyv2:1.27.9 imageID: docker.io/istio/proxyv2@sha256:e810b82e84ba7d8bb8e45c953199dde7145dd76a20252ee073e3532a0624a691 lastState: {} name: istio-proxy ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-03T03:59:21Z" hostIP: 172.20.0.3 hostIPs: - ip: 172.20.0.3 phase: Running podIP: 10.244.0.6 podIPs: - ip: 10.244.0.6 qosClass: Burstable startTime: "2026-06-03T03:59:18Z" - apiVersion: v1 kind: Pod metadata: annotations: prometheus.io/port: "15014" prometheus.io/scrape: "true" sidecar.istio.io/inject: "false" creationTimestamp: "2026-06-03T03:59:13Z" generateName: istiod-54b585df85- labels: app: istiod app.kubernetes.io/instance: istiod app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: istiod-1.27.9 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/dataplane-mode: none istio.io/rev: default operator.istio.io/component: Pilot pod-template-hash: 54b585df85 sidecar.istio.io/inject: "false" name: istiod-54b585df85-454xp namespace: istio-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: istiod-54b585df85 uid: ed3a68c3-87b9-4325-a9c4-2fa8d2bc7f8e resourceVersion: "573" uid: 692f3e34-071b-4a9c-b4e4-98ae6dccd330 spec: containers: - args: - discovery - --monitoringAddr=:15014 - --log_output_level=default:info - --domain - cluster.local - --keepaliveMaxServerConnectionAge - 30m env: - name: REVISION value: default - name: PILOT_CERT_PROVIDER value: istiod - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: SERVICE_ACCOUNT valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: KUBECONFIG value: /var/run/secrets/remote/config - name: CA_TRUSTED_NODE_ACCOUNTS value: istio-system/ztunnel - name: PILOT_TRACE_SAMPLING value: "1" - name: PILOT_ENABLE_ANALYSIS value: "false" - name: CLUSTER_ID value: Kubernetes - name: GOMEMLIMIT valueFrom: resourceFieldRef: divisor: "1" resource: limits.memory - name: GOMAXPROCS valueFrom: resourceFieldRef: divisor: "1" resource: limits.cpu - name: PLATFORM image: docker.io/istio/pilot:1.27.9 imagePullPolicy: IfNotPresent name: discovery ports: - containerPort: 8080 name: http-debug protocol: TCP - containerPort: 15010 name: grpc-xds protocol: TCP - containerPort: 15012 name: tls-xds protocol: TCP - containerPort: 15017 name: https-webhooks protocol: TCP - containerPort: 15014 name: http-monitoring protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 8080 scheme: HTTP initialDelaySeconds: 1 periodSeconds: 3 successThreshold: 1 timeoutSeconds: 5 resources: requests: cpu: 100m memory: 384Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/tokens name: istio-token readOnly: true - mountPath: /var/run/secrets/istio-dns name: local-certs - mountPath: /etc/cacerts name: cacerts readOnly: true - mountPath: /var/run/secrets/remote name: istio-kubeconfig readOnly: true - mountPath: /var/run/secrets/istiod/tls name: istio-csr-dns-cert readOnly: true - mountPath: /var/run/secrets/istiod/ca name: istio-csr-ca-configmap readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-xxvbs readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-15-control-plane preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: istiod serviceAccountName: istiod terminationGracePeriodSeconds: 30 tolerations: - key: cni.istio.io/not-ready operator: Exists - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - emptyDir: medium: Memory name: local-certs - name: istio-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: istio-ca expirationSeconds: 43200 path: istio-token - name: cacerts secret: defaultMode: 420 optional: true secretName: cacerts - name: istio-kubeconfig secret: defaultMode: 420 optional: true secretName: istio-kubeconfig - name: istio-csr-dns-cert secret: defaultMode: 420 optional: true secretName: istiod-tls - configMap: defaultMode: 420 name: istio-ca-root-cert optional: true name: istio-csr-ca-configmap - name: kube-api-access-xxvbs projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-03T03:59:17Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-03T03:59:13Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-03T03:59:18Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-03T03:59:18Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-03T03:59:13Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://cc5331bb9398beca31f12ec8d6bb7e302c86fef8a66db1ef4a9ac9370d75a6f7 image: docker.io/istio/pilot:1.27.9 imageID: docker.io/istio/pilot@sha256:71e17cc6b735f57901063de073d3c14bcd1bd7108947b6c375f4acc2e7332771 lastState: {} name: discovery ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-03T03:59:16Z" hostIP: 172.20.0.3 hostIPs: - ip: 172.20.0.3 phase: Running podIP: 10.244.0.5 podIPs: - ip: 10.244.0.5 qosClass: Burstable startTime: "2026-06-03T03:59:13Z" - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: istio-ingressgateway meta.helm.sh/release-namespace: istio-system creationTimestamp: "2026-06-03T03:59:18Z" labels: app: istio-ingressgateway app.kubernetes.io/instance: istio-ingressgateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: gateway-1.27.9 istio: ingressgateway istio.io/dataplane-mode: none name: istio-ingressgateway namespace: istio-system resourceVersion: "590" uid: 328c2e0e-9f29-4cf2-83c6-79eb56b379b6 spec: clusterIP: 10.96.88.152 clusterIPs: - 10.96.88.152 externalTrafficPolicy: Cluster internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: http2 nodePort: 30080 port: 80 protocol: TCP targetPort: 80 selector: app: istio-ingressgateway istio: ingressgateway sessionAffinity: None type: NodePort status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: istiod meta.helm.sh/release-namespace: istio-system creationTimestamp: "2026-06-03T03:59:13Z" labels: app: istiod app.kubernetes.io/instance: istiod app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: istiod-1.27.9 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/rev: default operator.istio.io/component: Pilot release: istiod name: istiod namespace: istio-system resourceVersion: "519" uid: 685b64b1-b4ce-439e-a3a0-c69df4d4ed99 spec: clusterIP: 10.96.240.28 clusterIPs: - 10.96.240.28 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: grpc-xds port: 15010 protocol: TCP targetPort: 15010 - name: https-dns port: 15012 protocol: TCP targetPort: 15012 - name: https-webhook port: 443 protocol: TCP targetPort: 15017 - name: http-monitoring port: 15014 protocol: TCP targetPort: 15014 selector: app: istiod istio: pilot sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: istio-ingressgateway meta.helm.sh/release-namespace: istio-system creationTimestamp: "2026-06-03T03:59:18Z" generation: 1 labels: app: istio-ingressgateway app.kubernetes.io/instance: istio-ingressgateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: gateway-1.27.9 istio: ingressgateway istio.io/dataplane-mode: none name: istio-ingressgateway namespace: istio-system resourceVersion: "621" uid: 69160512-4b7f-404a-80ba-e161ad3fdce8 spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app: istio-ingressgateway istio: ingressgateway strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: annotations: inject.istio.io/templates: gateway prometheus.io/path: /stats/prometheus prometheus.io/port: "15020" prometheus.io/scrape: "true" sidecar.istio.io/inject: "true" creationTimestamp: null labels: app: istio-ingressgateway app.kubernetes.io/instance: istio-ingressgateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: gateway-1.27.9 istio: ingressgateway istio.io/dataplane-mode: none sidecar.istio.io/inject: "true" spec: containers: - image: auto imagePullPolicy: Always name: istio-proxy ports: - containerPort: 15090 name: http-envoy-prom protocol: TCP resources: limits: cpu: "2" memory: 1Gi requests: cpu: 100m memory: 128Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 1337 runAsNonRoot: true runAsUser: 1337 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: sysctls: - name: net.ipv4.ip_unprivileged_port_start value: "0" serviceAccount: istio-ingressgateway serviceAccountName: istio-ingressgateway terminationGracePeriodSeconds: 30 status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-03T03:59:22Z" lastUpdateTime: "2026-06-03T03:59:22Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-03T03:59:18Z" lastUpdateTime: "2026-06-03T03:59:22Z" message: ReplicaSet "istio-ingressgateway-8584b67974" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: istiod meta.helm.sh/release-namespace: istio-system creationTimestamp: "2026-06-03T03:59:13Z" generation: 1 labels: app: istiod app.kubernetes.io/instance: istiod app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: istiod-1.27.9 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/rev: default operator.istio.io/component: Pilot release: istiod name: istiod namespace: istio-system resourceVersion: "579" uid: d46abdaa-688f-4d8a-9b02-54f310c29b0b spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: istio: pilot strategy: rollingUpdate: maxSurge: 100% maxUnavailable: 25% type: RollingUpdate template: metadata: annotations: prometheus.io/port: "15014" prometheus.io/scrape: "true" sidecar.istio.io/inject: "false" creationTimestamp: null labels: app: istiod app.kubernetes.io/instance: istiod app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: istiod-1.27.9 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/dataplane-mode: none istio.io/rev: default operator.istio.io/component: Pilot sidecar.istio.io/inject: "false" spec: containers: - args: - discovery - --monitoringAddr=:15014 - --log_output_level=default:info - --domain - cluster.local - --keepaliveMaxServerConnectionAge - 30m env: - name: REVISION value: default - name: PILOT_CERT_PROVIDER value: istiod - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: SERVICE_ACCOUNT valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: KUBECONFIG value: /var/run/secrets/remote/config - name: CA_TRUSTED_NODE_ACCOUNTS value: istio-system/ztunnel - name: PILOT_TRACE_SAMPLING value: "1" - name: PILOT_ENABLE_ANALYSIS value: "false" - name: CLUSTER_ID value: Kubernetes - name: GOMEMLIMIT valueFrom: resourceFieldRef: divisor: "1" resource: limits.memory - name: GOMAXPROCS valueFrom: resourceFieldRef: divisor: "1" resource: limits.cpu - name: PLATFORM image: docker.io/istio/pilot:1.27.9 imagePullPolicy: IfNotPresent name: discovery ports: - containerPort: 8080 name: http-debug protocol: TCP - containerPort: 15010 name: grpc-xds protocol: TCP - containerPort: 15012 name: tls-xds protocol: TCP - containerPort: 15017 name: https-webhooks protocol: TCP - containerPort: 15014 name: http-monitoring protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 8080 scheme: HTTP initialDelaySeconds: 1 periodSeconds: 3 successThreshold: 1 timeoutSeconds: 5 resources: requests: cpu: 100m memory: 384Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/tokens name: istio-token readOnly: true - mountPath: /var/run/secrets/istio-dns name: local-certs - mountPath: /etc/cacerts name: cacerts readOnly: true - mountPath: /var/run/secrets/remote name: istio-kubeconfig readOnly: true - mountPath: /var/run/secrets/istiod/tls name: istio-csr-dns-cert readOnly: true - mountPath: /var/run/secrets/istiod/ca name: istio-csr-ca-configmap readOnly: true dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: istiod serviceAccountName: istiod terminationGracePeriodSeconds: 30 tolerations: - key: cni.istio.io/not-ready operator: Exists volumes: - emptyDir: medium: Memory name: local-certs - name: istio-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: istio-ca expirationSeconds: 43200 path: istio-token - name: cacerts secret: defaultMode: 420 optional: true secretName: cacerts - name: istio-kubeconfig secret: defaultMode: 420 optional: true secretName: istio-kubeconfig - name: istio-csr-dns-cert secret: defaultMode: 420 optional: true secretName: istiod-tls - configMap: defaultMode: 420 name: istio-ca-root-cert optional: true name: istio-csr-ca-configmap status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-03T03:59:18Z" lastUpdateTime: "2026-06-03T03:59:18Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-03T03:59:13Z" lastUpdateTime: "2026-06-03T03:59:18Z" message: ReplicaSet "istiod-54b585df85" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: istio-ingressgateway meta.helm.sh/release-namespace: istio-system creationTimestamp: "2026-06-03T03:59:18Z" generation: 1 labels: app: istio-ingressgateway app.kubernetes.io/instance: istio-ingressgateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: gateway-1.27.9 istio: ingressgateway istio.io/dataplane-mode: none pod-template-hash: 8584b67974 sidecar.istio.io/inject: "true" name: istio-ingressgateway-8584b67974 namespace: istio-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: istio-ingressgateway uid: 69160512-4b7f-404a-80ba-e161ad3fdce8 resourceVersion: "620" uid: 39a3635e-6306-427a-91d6-8fb0f4405f7c spec: replicas: 1 selector: matchLabels: app: istio-ingressgateway istio: ingressgateway pod-template-hash: 8584b67974 template: metadata: annotations: inject.istio.io/templates: gateway prometheus.io/path: /stats/prometheus prometheus.io/port: "15020" prometheus.io/scrape: "true" sidecar.istio.io/inject: "true" creationTimestamp: null labels: app: istio-ingressgateway app.kubernetes.io/instance: istio-ingressgateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: gateway-1.27.9 istio: ingressgateway istio.io/dataplane-mode: none pod-template-hash: 8584b67974 sidecar.istio.io/inject: "true" spec: containers: - image: auto imagePullPolicy: Always name: istio-proxy ports: - containerPort: 15090 name: http-envoy-prom protocol: TCP resources: limits: cpu: "2" memory: 1Gi requests: cpu: 100m memory: 128Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 1337 runAsNonRoot: true runAsUser: 1337 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: sysctls: - name: net.ipv4.ip_unprivileged_port_start value: "0" serviceAccount: istio-ingressgateway serviceAccountName: istio-ingressgateway terminationGracePeriodSeconds: 30 status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: istiod meta.helm.sh/release-namespace: istio-system creationTimestamp: "2026-06-03T03:59:13Z" generation: 1 labels: app: istiod app.kubernetes.io/instance: istiod app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: istiod-1.27.9 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/dataplane-mode: none istio.io/rev: default operator.istio.io/component: Pilot pod-template-hash: 54b585df85 sidecar.istio.io/inject: "false" name: istiod-54b585df85 namespace: istio-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: istiod uid: d46abdaa-688f-4d8a-9b02-54f310c29b0b resourceVersion: "577" uid: ed3a68c3-87b9-4325-a9c4-2fa8d2bc7f8e spec: replicas: 1 selector: matchLabels: istio: pilot pod-template-hash: 54b585df85 template: metadata: annotations: prometheus.io/port: "15014" prometheus.io/scrape: "true" sidecar.istio.io/inject: "false" creationTimestamp: null labels: app: istiod app.kubernetes.io/instance: istiod app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: istiod-1.27.9 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/dataplane-mode: none istio.io/rev: default operator.istio.io/component: Pilot pod-template-hash: 54b585df85 sidecar.istio.io/inject: "false" spec: containers: - args: - discovery - --monitoringAddr=:15014 - --log_output_level=default:info - --domain - cluster.local - --keepaliveMaxServerConnectionAge - 30m env: - name: REVISION value: default - name: PILOT_CERT_PROVIDER value: istiod - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: SERVICE_ACCOUNT valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.serviceAccountName - name: KUBECONFIG value: /var/run/secrets/remote/config - name: CA_TRUSTED_NODE_ACCOUNTS value: istio-system/ztunnel - name: PILOT_TRACE_SAMPLING value: "1" - name: PILOT_ENABLE_ANALYSIS value: "false" - name: CLUSTER_ID value: Kubernetes - name: GOMEMLIMIT valueFrom: resourceFieldRef: divisor: "1" resource: limits.memory - name: GOMAXPROCS valueFrom: resourceFieldRef: divisor: "1" resource: limits.cpu - name: PLATFORM image: docker.io/istio/pilot:1.27.9 imagePullPolicy: IfNotPresent name: discovery ports: - containerPort: 8080 name: http-debug protocol: TCP - containerPort: 15010 name: grpc-xds protocol: TCP - containerPort: 15012 name: tls-xds protocol: TCP - containerPort: 15017 name: https-webhooks protocol: TCP - containerPort: 15014 name: http-monitoring protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 8080 scheme: HTTP initialDelaySeconds: 1 periodSeconds: 3 successThreshold: 1 timeoutSeconds: 5 resources: requests: cpu: 100m memory: 384Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/tokens name: istio-token readOnly: true - mountPath: /var/run/secrets/istio-dns name: local-certs - mountPath: /etc/cacerts name: cacerts readOnly: true - mountPath: /var/run/secrets/remote name: istio-kubeconfig readOnly: true - mountPath: /var/run/secrets/istiod/tls name: istio-csr-dns-cert readOnly: true - mountPath: /var/run/secrets/istiod/ca name: istio-csr-ca-configmap readOnly: true dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: istiod serviceAccountName: istiod terminationGracePeriodSeconds: 30 tolerations: - key: cni.istio.io/not-ready operator: Exists volumes: - emptyDir: medium: Memory name: local-certs - name: istio-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: istio-ca expirationSeconds: 43200 path: istio-token - name: cacerts secret: defaultMode: 420 optional: true secretName: cacerts - name: istio-kubeconfig secret: defaultMode: 420 optional: true secretName: istio-kubeconfig - name: istio-csr-dns-cert secret: defaultMode: 420 optional: true secretName: istiod-tls - configMap: defaultMode: 420 name: istio-ca-root-cert optional: true name: istio-csr-ca-configmap status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 - apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: annotations: meta.helm.sh/release-name: istio-ingressgateway meta.helm.sh/release-namespace: istio-system creationTimestamp: "2026-06-03T03:59:18Z" labels: app: istio-ingressgateway app.kubernetes.io/instance: istio-ingressgateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: gateway-1.27.9 istio: ingressgateway istio.io/dataplane-mode: none name: istio-ingressgateway namespace: istio-system resourceVersion: "693" uid: 94f7ac1d-a1f8-4a2d-a4b2-86beb621ed34 spec: maxReplicas: 5 metrics: - resource: name: cpu target: averageUtilization: 80 type: Utilization type: Resource minReplicas: 1 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: istio-ingressgateway status: conditions: - lastTransitionTime: "2026-06-03T03:59:33Z" message: the HPA controller was able to get the target's current scale reason: SucceededGetScale status: "True" type: AbleToScale - lastTransitionTime: "2026-06-03T03:59:33Z" message: 'the HPA was unable to compute the replica count: failed to get cpu utilization: unable to get metrics for resource cpu: unable to fetch metrics from resource metrics API: the server could not find the requested resource (get pods.metrics.k8s.io)' reason: FailedGetResourceMetric status: "False" type: ScalingActive currentMetrics: - type: "" currentReplicas: 1 desiredReplicas: 0 - apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: annotations: meta.helm.sh/release-name: istiod meta.helm.sh/release-namespace: istio-system creationTimestamp: "2026-06-03T03:59:13Z" labels: app: istiod app.kubernetes.io/instance: istiod app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.27.9 helm.sh/chart: istiod-1.27.9 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Pilot release: istiod name: istiod namespace: istio-system resourceVersion: "679" uid: 84952346-0d63-4046-88f3-f085a6e46bed spec: maxReplicas: 5 metrics: - resource: name: cpu target: averageUtilization: 80 type: Utilization type: Resource minReplicas: 1 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: istiod status: conditions: - lastTransitionTime: "2026-06-03T03:59:28Z" message: the HPA controller was able to get the target's current scale reason: SucceededGetScale status: "True" type: AbleToScale - lastTransitionTime: "2026-06-03T03:59:28Z" message: 'the HPA was unable to compute the replica count: failed to get cpu utilization: unable to get metrics for resource cpu: unable to fetch metrics from resource metrics API: the server could not find the requested resource (get pods.metrics.k8s.io)' reason: FailedGetResourceMetric status: "False" type: ScalingActive currentMetrics: - type: "" currentReplicas: 1 desiredReplicas: 0 kind: List metadata: resourceVersion: ""