apiVersion: v1
kind: ConfigMap
metadata:
  name: mesh
  namespace: istio-system
  labels:
    release: istiod
data:

  mesh: |
    # Default config. Will be included in the image/deb.
    # User config will replace it via a volume mount.

    # This file has all the defaults from the code, but adjusted to include more stable prod settings.

    # TODO: merge this with a user-mesh.yaml with overrides ?

    #localityLbSettings:

    # By default use the built-in MCP server.
    #configSources:
    #  - address: localhost:15901


    # Set enableTracing to false to disable request tracing.
    # Off by default. Should be enabled only if a tracer is installed, and ideally configured
    # for specific workloads.
    enableTracing:                     false

    ###  Defaults

    # Set accessLogFile to empty string to disable access log.
    accessLogFile:                     "/dev/stdout"
    accessLogEncoding:                 TEXT
    accessLogFormat: ""
    enableEnvoyAccessLogService: false

    connectTimeout:                    1s

    defaultServiceExportTo:            ["*"]
    defaultVirtualServiceExportTo:     ["*"]
    defaultDestinationRuleExportTo:    ["*"]

    # Assume Mixerv2 or telemetry lite will be used by default.
    mixerCheckServer: ""
    mixerReportServer: ""
    disablePolicyChecks: true
    disableMixerHttpReports: true
    policyCheckFailOpen:               false
    sidecarToTelemetrySessionAffinity: false

    h2UpgradePolicy: UPGRADE

    rootNamespace:                     "istio-system"

    # If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
    tcpKeepalive:
      probes: 9
      time: 7200s
      interval: 75s

    proxyListenPort:                   15001

    # This is the k8s ingress service name, update if you used a different name
    ingressService:                    "istio-ingressgateway"
    ingressControllerMode: DEFAULT
    ingressClass: "istio"

    # Temp
    sdsUdsPath:                        "unix:/etc/istio/proxy/SDS"


    enableSdsTokenMount:               false

    trustDomain:                       "cluster.local"

    outboundTrafficPolicy:
      mode: ALLOW_ANY

    dnsRefreshRate:                    5s
    protocolDetectionTimeout:          100ms

    enableAutoMtls: false

    # Extra
    authPolicy: NONE

    # Port on which Envoy should listen for HTTP PROXY requests if set.
    proxyHttpPort: 15080

    defaultConfig:
      configPath: /etc/istio/proxy

      binaryPath: /usr/local/bin/envoy

      serviceCluster: istio-proxy

      drainDuration: 45s

      parentShutdownDuration: 60s

      controlPlaneAuthPolicy: NONE
      discoveryAddress: istiod.istio-system.svc:15012

      connectTimeout: 1s

      statsdUdpAddress: ""

      envoyMetricsService: {}
      envoyAccessLogService: {}

      proxyAdminPort: 15000

      interceptionMode: REDIRECT

      #customConfigFile: "conf/sidecar/envoy_bootstrap_v2.json"

      concurrency: 0

      statNameLength: 189

      #tracing:
      #  zipkin:
      #    # Address of the Zipkin collector
      #    address: zipkin.istio-control:9411
