# istio_pilot_override_kubernetes.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: empty
  hub: registry.istio.io/release
  tag: 1.1.4
  meshConfig:
    rootNamespace: istio-control
  components:
    base:
      enabled: true
      k8s:
        # Base component only allows overlays field.
        overlays:
          - kind: ServiceAccount
            name: istio-reader-service-account
            patches:
              # Select list item by value
              - path: spec.automountServiceAccountToken
                value: false

    pilot:
      enabled: true
      namespace: istio-control
      k8s:
        podDisruptionBudget:
          maxUnavailable: 1
        resources:
          requests:
            cpu: 123m
        overlays:
          - kind: Deployment
            name: istiod
            patches:
              # Select list item by value
              - path: spec.template.spec.containers.[name:discovery].args.[30m]
                value: "60m" # OVERRIDDEN
              # Select list item by key:value
              - path: spec.template.spec.containers.[name:discovery].ports.[containerPort:8080].containerPort
                value: 1234 # OVERRIDDEN
              # Override with object (note | on value: first line)
              - path: spec.template.spec.containers.[name:discovery].env.[name:POD_NAMESPACE].valueFrom
                value: |
                  fieldRef:
                    apiVersion: v2
                    fieldPath: metadata.myPath
              # Deletion of list item
              - path: spec.template.spec.containers.[name:discovery].env.[name:REVISION]
              # Deletion of map item
              - path: spec.template.spec.containers.[name:discovery].securityContext
          - kind: Service
            name: istiod
            patches:
              - path: spec.ports.[name:https-dns].port
                value: 11111 # OVERRIDDEN
          # Cluster scope resource
          - kind: MutatingWebhookConfiguration
            name: istio-sidecar-injector-istio-control
            patches:
              - path: webhooks.[name:namespace\.sidecar-injector\.istio\.io].clientConfig.service.name
                value: foo