fix: set Istio attributes properly again

charts/kubezero/templates/cert-manager.yaml

@@ -31,8 +31,10 @@ cert-manager:
     nodeSelector:
       node-role.kubernetes.io/control-plane: ""
 
-  {{ with index .Values "cert-manager" "IamArn" }}
   extraEnv:
+  - name: AWS_REGION
+    value: {{ .Values.global.aws.region }}
+  {{ with index .Values "cert-manager" "IamArn" }}
   - name: AWS_ROLE_ARN
     value: "{{ . }}"
   - name: AWS_WEB_IDENTITY_TOKEN_FILE

charts/kubezero/templates/istio-ingress.yaml

@@ -4,7 +4,7 @@ gateway:
   name: istio-ingressgateway
 
   {{- if ne .Values.global.platform "gke" }}
-    priorityClassName: "system-cluster-critical"
+  priorityClassName: "system-cluster-critical"
   {{- end }}
 
   {{- with index .Values "istio-ingress" "gateway" "replicaCount" }}

charts/kubezero/templates/istio-private-ingress.yaml

@@ -3,6 +3,10 @@
 gateway:
   name: istio-private-ingressgateway
 
+  {{- if ne .Values.global.platform "gke" }}
+  priorityClassName: "system-cluster-critical"
+  {{- end }}
+
   {{- with index .Values "istio-private-ingress" "gateway" "replicaCount" }}
   replicaCount: {{ . }}
   {{- if gt (int .) 1 }}
@@ -11,7 +15,7 @@ gateway:
   {{- end }}
   {{- end }}
 
-  {{- if not (index .Values "istio-private-ingress" "gateway" "affinity") }}
+  {{- if eq .Values.global.platform "aws" }}
   # Only nodes who are fronted with matching LB
   affinity:
     nodeAffinity:

charts/kubezero/templates/istio.yaml

@@ -5,7 +5,7 @@ global:
   defaultPodDisruptionBudget:
     enabled: true
   {{- if ne .Values.global.platform "gke" }}
-    priorityClassName: "system-cluster-critical"
+  priorityClassName: "system-cluster-critical"
   {{- end }}
 {{- end }}