// https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md
  // +optional
  optional Overhead overhead = 3;

  // scheduling holds the scheduling constraints to ensure that pods running
  // with this RuntimeClass are scheduled to nodes that support it.
  // If scheduling is nil, this RuntimeClass is assumed to be supported by all
  // nodes.
  // +optional
  optional Scheduling scheduling = 4;
}

      - "rbac.istio.io"
      - "telemetry.istio.io"
      - "extensions.istio.io"
    resources: ["*"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["networking.istio.io"]
    verbs: [ "get", "watch", "list" ]
    resources: [ "workloadentries" ]

  repeated RuntimeClass items = 2;
}

// Scheduling specifies the scheduling constraints for nodes supporting a
// RuntimeClass.
message Scheduling {
  // nodeSelector lists labels that must be present on nodes that support this
  // RuntimeClass. Pods using this RuntimeClass can only be scheduled to a
  // node matched by this selector. The RuntimeClass nodeSelector is merged

  // https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md
  // +optional
  optional Overhead overhead = 2;

  // scheduling holds the scheduling constraints to ensure that pods running
  // with this RuntimeClass are scheduled to nodes that support it.
  // If scheduling is nil, this RuntimeClass is assumed to be supported by all
  // nodes.
  // +optional
  optional Scheduling scheduling = 3;
}

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // nodeTopology defines which nodes have access to the storage
  // for which capacity was reported. If not set, the storage is
  // not accessible from any node in the cluster. If empty, the
  // storage is accessible from all nodes. This field is
  // immutable.
  //
  // +optional

  # discovery and routing
  - apiGroups: [""]
    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["discovery.k8s.io"]
    resources: ["endpointslices"]
    verbs: ["get", "list", "watch"]

{{- if .Values.pilot.taint.enabled }}
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["patch"]
{{- end }}

  # ingress controller

  # discovery and routing
  - apiGroups: [""]
    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["discovery.k8s.io"]
    resources: ["endpointslices"]
    verbs: ["get", "list", "watch"]

{{- if .Values.pilot.taint.enabled }}
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["patch"]
{{- end }}

  # ingress controller

// ClusterCIDR represents a single configuration for per-Node Pod CIDR
// allocations when the MultiCIDRRangeAllocator is enabled (see the config for
// kube-controller-manager).  A cluster may have any number of ClusterCIDR
// resources, all of which will be considered when allocating a CIDR for a
// Node.  A ClusterCIDR is eligible to be used for a given Node when the node
// selector matches the node in question and has free CIDRs to allocate.  In

        kubernetes.io/os: linux
      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
      {{- with .Values.cni.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      tolerations:
        # Make sure istio-cni-node gets scheduled on all nodes.
        - effect: NoSchedule
          operator: Exists
        # Mark the pod as a critical add-on for rescheduling.

    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Cni"
rules:
- apiGroups: [""]
  resources: ["pods","nodes","namespaces"]
  verbs: ["get", "list", "watch"]
{{- if (eq .Values.platform "openshift") }}
- apiGroups: ["security.openshift.io"]
  resources: ["securitycontextconstraints"]
  resourceNames: ["privileged"]