Because Ztunnel can have Istio semantics baked in, we do not need to encode all this information on the wire.
Instead, an Istio specific field like `ExpectedTLSIdentity: spiffe://foo.bar` can encode the same information, at a fraction of the cost.

) (validation.Warning, error) {
	decoder := yaml.NewDecoder(reader)
	decoder.SetStrict(true)
	var errs error
	var warnings validation.Warning
	for {
		// YAML allows non-string keys and the produces generic keys for nested fields
		raw := make(map[any]any)
		err := decoder.Decode(&raw)
		if err == io.EOF {
			return warnings, errs
		}
		if err != nil {

	}
	return scopeInfos, nil
}

func (c *ControlzClient) PutScope(scope *ScopeInfo) error {
	var jsonScopeInfo bytes.Buffer
	err := json.NewEncoder(&jsonScopeInfo).Encode(scope)
	if err != nil {
		return fmt.Errorf("cannot serialize scope %+v", *scope)
	}
	req, err := http.NewRequest(http.MethodPut, c.baseURL.String()+"/"+scope.Name, &jsonScopeInfo)
	if err != nil {
		return err

	for _, response := range responses {
		retval[CpInfo(response).ID] = response
	}

	return retval, nil
}

// CpInfo returns the Istio control plane info from JSON-encoded XDS ControlPlane Identifier
func CpInfo(xdsResponse *discovery.DiscoveryResponse) pilotxds.IstioControlPlaneInstance {
	if xdsResponse.ControlPlane == nil {
		return pilotxds.IstioControlPlaneInstance{

			version.Info.Version))
	}
	return cfg, err
}

// grabs the raw values from the ConfigMap. These are encoded as JSON.
func GetValuesFromConfigMap(ctx cli.Context, revision string) (string, error) {
	client, err := ctx.CLIClient()
	if err != nil {
		return "", err
	}

	if revision != "" {

  //
  // If the webhook is running within the cluster, then you should use `service`.
  //
  // +optional
  optional ServiceReference service = 1;

  // `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
  // If unspecified, system trust roots on the apiserver are used.
  // +optional
  optional bytes caBundle = 2;

  //
  // If the webhook is running within the cluster, then you should use `service`.
  //
  // +optional
  optional ServiceReference service = 1;

  // `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
  // If unspecified, system trust roots on the apiserver are used.
  // +optional
  optional bytes caBundle = 2;

  optional string metricName = 2;

  // targetValue is the target value of the metric (as a quantity).
  optional k8s.io.apimachinery.pkg.api.resource.Quantity targetValue = 3;

  // selector is the string-encoded form of a standard kubernetes label selector for the given metric
  // When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping

}

// MetricIdentifier defines the name and optionally selector for a metric
message MetricIdentifier {
  // name is the name of the given metric
  optional string name = 1;

  // selector is the string-encoded form of a standard kubernetes label selector for the given metric
  // When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping.

// CertificateSigningRequestSpec contains the certificate request.
message CertificateSigningRequestSpec {
  // request contains an x509 certificate signing request encoded in a "CERTIFICATE REQUEST" PEM block.
  // When serialized as JSON or YAML, the data is additionally base64-encoded.
  // +listType=atomic
  optional bytes request = 1;

  // signerName indicates the requested signer, and is a qualified name.
  //