// items is a list of schema objects.
  repeated NetworkPolicy items = 2;
}

// NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of
// fields are allowed
message NetworkPolicyPeer {
  // podSelector is a label selector which selects pods. This field follows standard label
  // selector semantics; if present but empty, it selects all pods.
  //

  // +optional
  optional int64 startingDeadlineSeconds = 2;

  // Specifies how to treat concurrent executions of a Job.
  // Valid values are:
  //
  // - "Allow" (default): allows CronJobs to run concurrently;
  // - "Forbid": forbids concurrent runs, skipping next run if previous run hasn't finished yet;
  // - "Replace": cancels currently running job and replaces it with a new one
  // +optional

        - "sidecar.istio.io/status" exists

### Redirect API

The annotation based control is currently only supported in 'sidecar' mode. See plugin/redirect.go for details.

- redirectMode allows TPROXY may to be set, required envoy has extra permissions. Default is redirect.
- includeIPCidr, excludeIPCidr
- includeInboudPorts, excludeInboundPorts
- includeOutboutPorts, excludeOutboundPorts
- excludeInterfaces

  // +optional
  optional ContainerResourceMetricSource containerResource = 7;

  // external refers to a global metric that is not associated
  // with any Kubernetes object. It allows autoscaling based on information
  // coming from components running outside of cluster
  // (for example length of queue in cloud messaging service, or
  // QPS from loadbalancer running outside of cluster).
  // +optional

  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:
  // 1. IPs are not allowed. Currently an IngressRuleValue can only apply to
  //    the IP in the Spec of the parent Ingress.
  // 2. The `:` delimiter is not respected because ports are not allowed.
  // 	  Currently the port of an Ingress is implicitly :80 for http and
  // 	  :443 for https.
  // Both these may change in the future.

namespace "istio.io/rev=prod". The "prod" revision tag could point to "1-7-6" initially and then be changed to point to "1-8-1"
at some later point.

This allows operators to change which Istio control plane revision should handle injection for a namespace or set of namespaces
without manual relabeling of the "istio.io/rev" tag.
`,
		Args: func(cmd *cobra.Command, args []string) error {

  // +optional
  optional ContainerResourceMetricSource containerResource = 7;

  // external refers to a global metric that is not associated
  // with any Kubernetes object. It allows autoscaling based on information
  // coming from components running outside of cluster
  // (for example length of queue in cloud messaging service, or
  // QPS from loadbalancer running outside of cluster).
  // +optional

) (validation.Warning, error) {
	decoder := yaml.NewDecoder(reader)
	decoder.SetStrict(true)
	var errs error
	var warnings validation.Warning
	for {
		// YAML allows non-string keys and the produces generic keys for nested fields
		raw := make(map[any]any)
		err := decoder.Decode(&raw)
		if err == io.EOF {
			return warnings, errs
		}
		if err != nil {

RELEASE_LDFLAGS=''
else
RELEASE_LDFLAGS='-extldflags -static -s -w'
endif

# List of all binaries to build
# We split the binaries into "agent" binaries and standard ones. This corresponds to build "agent".
# This allows conditional compilation to avoid pulling in costly dependencies to the agent, such as XDS and k8s.
AGENT_BINARIES:=./pilot/cmd/pilot-agent
STANDARD_BINARIES:=./istioctl/cmd/istioctl \
  ./pilot/cmd/pilot-discovery \

  // (and serves solely to ensure that the pods it selects are isolated by default).
  // +optional
  repeated NetworkPolicyIngressRule ingress = 2;

  // List of egress rules to be applied to the selected pods. Outgoing traffic is
  // allowed if there are no NetworkPolicies selecting the pod (and cluster policy