// This field is immutable.
  // +optional
  optional k8s.io.api.core.v1.NodeSelector nodeSelector = 1;

  // perNodeHostBits defines the number of host bits to be configured per node.
  // A subnet mask determines how much of the address is used for network bits
  // and host bits. For example an IPv4 address of 192.168.0.0/24, splits the
  // address into 24 bits for the network portion and 8 bits for the host portion.

1. First, the request is handled by the SDS server. This is mostly just an intermediate translation layer exposing
   the `SecretManager` to Envoy, without much business logic. For each resource requested by Envoy, the SDS server
   will call `SecretManager.GenerateSecret(resourceName)`

THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

  // flag to the Kubernetes controller manager.
  //
  // Certificate signers may not honor this field for various reasons:
  //
  //   1. Old signer that is unaware of the field (such as the in-tree
  //      implementations prior to v1.22)
  //   2. Signer whose configured maximum is shorter than the requested duration
  //   3. Signer whose configured minimum is longer than the requested duration
  //

  // Only one PriorityClass can be marked as `globalDefault`. However, if more than
  // one PriorityClasses exists with their `globalDefault` field set to true,
  // the smallest value of such global default PriorityClasses will be used as the default priority.
  // +optional
  optional bool globalDefault = 3;

  // description is an arbitrary string that usually provides guidelines on

This allows configuration without re-installing or restarting deployments.

If the change is to a Kubernetes field (such as modifying a Deployment attribute), it will likely need to be install-time configuration.
However, that doesn't necessarily mean a PR to add a value will be accepted.

			WantException:  true,
		},
		{ // case 1
			Args:           strings.Split("-f missing.yaml", " "),
			ExpectedRegexp: regexp.MustCompile(`open missing.yaml: no such file or directory`),
			WantException:  true,
		},
		{ // case 2
			Args: strings.Split(
				"--meshConfigFile testdata/mesh-config.yaml"+

    "global.tracer.datadog.address" "meshConfig.defaultConfig.tracing.datadog.address"
    "global.meshExpansion.enabled" "Gateway and other Istio networking resources, such as in samples/multicluster/"
    "istiocoredns.enabled" "the in-proxy DNS capturing (ISTIO_META_DNS_CAPTURE)"
}}
{{- range $dep, $replace := $deps }}