// will fulfill this Template, but have a unique identity from the rest
  // of the StatefulSet. Each pod will be named with the format
  // <statefulsetname>-<podindex>. For example, a pod in a StatefulSet named
  // "web" with index number "3" would be named "web-3".
  // The only allowed template.spec.restartPolicy value is "Always".
  optional k8s.io.api.core.v1.PodTemplateSpec template = 3;

  // If not specified, this field defaults to TCP.
  // +optional
  optional string protocol = 1;

  // port represents the port on the given protocol. This can either be a numerical or named
  // port on a pod. If this field is not provided, this matches all port names and
  // numbers.
  // If present, only traffic on the specified protocol AND port will be matched.
  // +optional

  // will fulfill this Template, but have a unique identity from the rest
  // of the StatefulSet. Each pod will be named with the format
  // <statefulsetname>-<podindex>. For example, a pod in a StatefulSet named
  // "web" with index number "3" would be named "web-3".
  // The only allowed template.spec.restartPolicy value is "Always".
  optional k8s.io.api.core.v1.PodTemplateSpec template = 3;

#### Gateway

Gateway (referring to the [Kubernetes API](http://gateway-api.org/), not the same-named Istio type) works very similarly to [Ingress](#ingress). The Gateway controller also converts Gateway API types into `VirtualService` and `Gateway`, implementing the `ConfigStore` interface.

  // If not specified, this field defaults to TCP.
  // +optional
  optional string protocol = 1;

  // The port on the given protocol. This can either be a numerical or named
  // port on a pod. If this field is not provided, this matches all port names and
  // numbers.
  // If present, only traffic on the specified protocol AND port will be matched.
  // +optional

  // will fulfill this Template, but have a unique identity from the rest
  // of the StatefulSet. Each pod will be named with the format
  // <statefulsetname>-<podindex>. For example, a pod in a StatefulSet named
  // "web" with index number "3" would be named "web-3".
  optional k8s.io.api.core.v1.PodTemplateSpec template = 3;

  // volumeClaimTemplates is a list of claims that pods are allowed to reference.

  // 	  "import", "let", "loop", "package", "namespace", "return".
  // Examples:
  //   - Expression accessing a property named "namespace": {"Expression": "object.__namespace__ > 0"}
  //   - Expression accessing a property named "x-prop": {"Expression": "object.x__dash__prop > 0"}
  //   - Expression accessing a property named "redact__d": {"Expression": "object.redact__underscores__d > 0"}
  //

	}

	return 0, fmt.Errorf("unable to get fd")
}

/// mostly copy pasted from spire below:

// regexes listed here have to exclusively match a cgroup path
// the regexes must include two named groups "poduid" and "containerid"
// if the regex needs to exclude certain substrings, the "mustnotmatch" group can be used
// nolint: lll
var cgroupREs = []*regexp.Regexp{