// Namespace is the namespace of the action being requested.  Currently, there is no distinction between no namespace and all namespaces
  // "" (empty) is defaulted for LocalSubjectAccessReviews
  // "" (empty) is empty for cluster-scoped resources
  // "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview
  // +optional
  optional string namespace = 1;

to view the last 1000 `kubelet` logs via the `less` utility to allow for `vi`-style searching:

```console
$ journalctl -t kubelet -n 1000 | less
```

#### GKE via Stackdriver Log Viewer

Each GKE cluster's will have many categories of logs collected by Stackdriver.  Logs can be monitored via
the project's [log viewer](https://cloud.google.com/logging/docs/view/overview) and/or the `gcloud logging read`
capability.

  // This service must exist before the StatefulSet, and is responsible for
  // the network identity of the set. Pods get DNS/hostnames that follow the
  // pattern: pod-specific-string.serviceName.default.svc.cluster.local
  // where "pod-specific-string" is managed by the StatefulSet controller.
  optional string serviceName = 5;

  // podManagementPolicy controls how pods are created during initial scale up,

  // Required.
  // +listType=atomic
  repeated string resources = 3;

  // scope specifies the scope of this rule.
  // Valid values are "Cluster", "Namespaced", and "*"
  // "Cluster" means that only cluster-scoped resources will match this rule.
  // Namespace API objects are cluster-scoped.
  // "Namespaced" means that only namespaced resources will match this rule.
  // "*" means that there are no scope restrictions.

Once the images are pushed, configure kubectl to point to your cluster and install the controller.

Install the controller manifest:

```bash
istioctl operator init --hub docker.io/<your-account> --tag latest
kubectl create ns istio-system
kubectl apply -f operator/samples/default-install.yaml
```

This installs the controller into the cluster in the istio-operator namespace. The controller in turns installs

  // scope represents if this refers to a cluster or namespace scoped resource.
  // This may be set to "Cluster" (default) or "Namespace".
  // +optional
  optional string scope = 4;

  // namespace is the namespace of the resource being referenced. This field is
  // required when scope is set to "Namespace" and must be unset when scope is set to
  // "Cluster".
  // +optional
  optional string namespace = 5;
}

option go_package = "k8s.io/api/storage/v1beta1";

// CSIDriver captures information about a Container Storage Interface (CSI)
// volume driver deployed on the cluster.
// CSI drivers do not need to create the CSIDriver object directly. Instead they may use the
// cluster-driver-registrar sidecar container. When deployed with a CSI driver it automatically
// creates a CSIDriver object representing the driver.

  * This includes UDP, non-compliant HTTP, server-first protocols, stateful sets, external services, etc.
  * Explicitly opting into behavioral changes can be acceptable. For example, introducing Istio multi-cluster semantics.
* Ensure traffic between mesh workloads is securely encrypted with an Istio identity.
* Be lightweight enough to not limit adoption.

  repeated FlowSchema items = 2;
}

// FlowSchemaSpec describes how the FlowSchema's specification looks like.
message FlowSchemaSpec {
  // `priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot
  // be resolved, the FlowSchema will be ignored and marked as invalid in its status.
  // Required.
  optional PriorityLevelConfigurationReference priorityLevelConfiguration = 1;

  repeated FlowSchema items = 2;
}

// FlowSchemaSpec describes how the FlowSchema's specification looks like.
message FlowSchemaSpec {
  // `priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot
  // be resolved, the FlowSchema will be ignored and marked as invalid in its status.
  // Required.
  optional PriorityLevelConfigurationReference priorityLevelConfiguration = 1;