// (and serves solely to ensure that the pods it selects are isolated by default).
  // +optional
  repeated NetworkPolicyIngressRule ingress = 2;

  // List of egress rules to be applied to the selected pods. Outgoing traffic is
  // allowed if there are no NetworkPolicies selecting the pod (and cluster policy

Contributors may not remove or alter any copyright notices contained within
the Program.

Each Contributor must identify itself as the originator of its Contribution,
if any, in a manner that reasonably allows subsequent Recipients to identify
the originator of the Contribution.

   4. COMMERCIAL DISTRIBUTION

Commercial distributors of software may accept certain responsibilities with

    }
    return Integer.MAX_VALUE
  }

  companion object {
    /**
     * How many redirects and auth challenges should we attempt? Chrome follows 21 redirects; Firefox,
     * curl, and wget follow 20; Safari follows 16; and HTTP/1.0 recommends 5.
     */
    private const val MAX_FOLLOW_UPS = 20
  }

However, all other types *cannot* be deleted explicitly, and instead are cleaned up when all references are removed. This means we can send partial updates for non-root types, without deleting unsent resources. This effectively allows doing delta updates over SotW. This optimization is critical for our endpoints generator, ensuring that when a pod scales we only need to update the endpoints within that pod.

    ```bash
    docker run -it --rm -v $PWD:/tmp -w /tmp tensorflow/build:2.15-python3.10
    ```

    Once you have the packages installed, you can run a specific unit test in
    bazel by doing as follows:

    ```bash
    export flags="--config=opt -k"
    ```

    If the tests are to be run on the GPU, add CUDA paths to LD_LIBRARY_PATH and
    add the `cuda` option flag

    ```bash

        - "sidecar.istio.io/status" exists

### Redirect API

The annotation based control is currently only supported in 'sidecar' mode. See plugin/redirect.go for details.

- redirectMode allows TPROXY may to be set, required envoy has extra permissions. Default is redirect.
- includeIPCidr, excludeIPCidr
- includeInboudPorts, excludeInboundPorts
- includeOutboutPorts, excludeOutboundPorts
- excludeInterfaces

  // volume claims created from volumeClaimTemplates. By default, all persistent
  // volume claims are created as needed and retained until manually deleted. This
  // policy allows the lifecycle to be altered, for example by deleting persistent
  // volume claims when their stateful set is deleted, or when their pod is scaled
  // down. This requires the StatefulSetAutoDeletePVC feature gate to be enabled,

    }
    assertThat(socket.enabledCipherSuites)
      .containsExactly(*expectedCipherSuites.toTypedArray())
  }

  @Test
  fun tls_stringCiphersAndVersions() {
    // Supporting arbitrary input strings allows users to enable suites and versions that are not
    // yet known to the library, but are supported by the platform.
    ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
      .cipherSuites("MAGIC-CIPHER")

    generalName.asSequenceOf()

  /**
   * This uses the preceding extension ID to select which adapter to use for the extension value
   * that follows.
   */
  private val extensionValue: BasicDerAdapter<Any?> =
    Adapters.usingTypeHint { typeHint ->
      when (typeHint) {
        ObjectIdentifiers.SUBJECT_ALTERNATIVE_NAME -> subjectAlternativeName

    // alternative subject starting with a japanese kanji character. This is
    // not supported by Android because the underlying implementation from
    // harmony follows the definition from rfc 1034 page 10 for alternative
    // subject names. This causes the code to drop all alternative subjects.
    assertThat(verifier.verify("bar.com", session)).isTrue()