message CSINodeDriver {
  // name represents the name of the CSI driver that this object refers to.
  // This MUST be the same name returned by the CSI GetPluginName() call for
  // that driver.
  optional string name = 1;

  // nodeID of the node from the driver point of view.
  // This field enables Kubernetes to communicate with storage systems that do
  // not share the same nomenclature for nodes. For example, Kubernetes may

  // +optional
  optional string apiGroup = 1;

  // Kind is the type of resource being referenced. This is the same
  // value as in the parameter object's metadata, for example "ConfigMap".
  optional string kind = 2;

  // Name is the name of resource being referenced.
  optional string name = 3;
}

// ResourceClaimSchedulingStatus contains information about one particular

            value: "60m" # OVERRIDDEN
          - path: spec.template.spec.containers.[name:discovery].ports.[containerPort:8080].containerPort
            value: 8090 # OVERRIDDEN
          - path: 'spec.template.spec.volumes[100]' #push to the list
            value:
              configMap:
                name: my-config-map
              name: my-volume-name

  // this list must have at least one matching (by name) volumeMount in one
  // container in the template. A claim in this list takes precedence over
  // any volumes in the template, with the same name.
  // TODO: Define the behavior if a claim already exists with the same name.
  // +optional
  repeated k8s.io.api.core.v1.PersistentVolumeClaim volumeClaimTemplates = 4;

  // serviceName is the name of the service that governs this StatefulSet.

}

// IngressServiceBackend references a Kubernetes Service as a Backend.
message IngressServiceBackend {
  // name is the referenced service. The service must exist in
  // the same namespace as the Ingress object.
  optional string name = 1;

  // port of the referenced service. A port name or port number
  // is required for a IngressServiceBackend.
  optional ServiceBackendPort port = 2;
}

message CSINodeDriver {
  // name represents the name of the CSI driver that this object refers to.
  // This MUST be the same name returned by the CSI GetPluginName() call for
  // that driver.
  optional string name = 1;

  // nodeID of the node from the driver point of view.
  // This field enables Kubernetes to communicate with storage systems that do
  // not share the same nomenclature for nodes. For example, Kubernetes may

      # have a shared root CA for this model to work.
      enabled: false
      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
      # to properly label proxies
      clusterName: ""

    # Network defines the network this cluster belong to. This name
    # corresponds to the networks in the map of mesh networks.
    network: ""

## HBONE

Along with pass-through traffic, Ztunnel supports the "HBONE" (HTTP-Based Overlay Network) protocol.
This is not really so much a new protocol, but rather a name we came up with to refer to the expectations of clients and servers communicating in the mesh.

HBONE is just a standard HTTP `CONNECT` tunnel, over mutual TLS with mesh (SPIFFE) certificates, on a well known port (15008).

// IngressClassSpec provides information about the class of an Ingress.
message IngressClassSpec {
  // controller refers to the name of the controller that should handle this
  // class. This allows for different "flavors" that are controlled by the
  // same controller. For example, you may have different parameters for the
  // same implementing controller. This should be specified as a
  // domain-prefixed path no more than 250 characters in length, e.g.

      comment syntax for the file format. We also recommend that a
      file or class name and description of purpose be included on the
      same "printed page" as the copyright notice for easier
      identification within third-party archives.

   Copyright [yyyy] [name of copyright owner]

   Licensed under the Apache License, Version 2.0 (the "License");