apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: empty
  components:
    ingressGateways:
      - name: istio-ingressgateway
        enabled: true
        label:
          aaa: aaa-val
          bbb: bbb-val
        k8s:
          resources:
            requests:
              cpu: 111m
              memory: 111Mi
      - name: user-ingressgateway
        enabled: true
        label:
          ccc: ccc-val
          ddd: ddd-val
        k8s:
          resources:
            requests:
              cpu: 222m
              memory: 888Mi
      - namespace: user-ingressgateway-ns
        name: ilb-gateway
        enabled: true
        k8s:
          resources:
            requests:
              cpu: 333m
          serviceAnnotations:
            cloud.google.com/load-balancer-type: "internal"
          service:
            ports:
            ## You can add custom gateway ports - google ILB default quota is 5 ports,
            - port: 15011
              name: grpc-pilot-mtls
            - port: 8060
              targetPort: 8060
              name: tcp-citadel-grpc-tls
            # Port 5353 is forwarded to kube-dns
            - port: 5353
              name: tcp-dns
          overlays:
            - kind: Deployment
              name: ilb-gateway
              patches:
                - path: spec.template.spec.containers.[name:istio-proxy].env.[name:PILOT_CERT_PROVIDER].value
                  value: foobar # OVERRIDDEN
