## Privileges required

In our testing, even the most generous representations give custom types a 10x edge (in size, allocations, and CPU time) over Envoy types.
In addition, they are more clear and strictly typed; using Envoy types would require us to put a lot of information in untyped `metadata` maps.

With this in mind, Ztunnel supports two xDS resources: `Address` and `Authorization`.

### Address Type

  # Generate the demo profile and don't wait for confirmation
  istioctl install --set profile=demo --skip-confirmation

  # To override a setting that includes dots, escape them with a backslash (\).  Your shell may require enclosing quotes.
  istioctl install --set "values.sidecarInjectorWebhook.injectedAnnotations.container\.apparmor\.security\.beta\.kubernetes\.io/istio-proxy=runtime/default"
`,
		Args: cobra.ExactArgs(0),

To override a setting that includes dots, escape them with a backslash (\).  Your shell may require enclosing quotes.

``` bash
istioctl manifest generate --set "values.sidecarInjectorWebhook.injectedAnnotations.container\.apparmor\.security\.beta\.kubernetes\.io/istio-proxy=runtime/default"
```

const (
	goldenFileSuffixHideChangesInReview = ".golden.yaml"
	goldenFileSuffixShowChangesInReview = ".golden-show-in-gh-pull-request.yaml"
)

var (
	// By default, tests only run with manifest generate, since it doesn't require any external fake test environment.
	testedManifestCmds = []cmdType{cmdGenerate}
	// Only used if kubebuilder is installed.
	testenv    *envtest.Environment
	testClient client.Client

  optional string controller = 1;

  // parameters is a link to a custom resource containing additional
  // configuration for the controller. This is optional if the controller does
  // not require extra parameters.
  // +optional
  optional IngressClassParametersReference parameters = 2;
}

// IngressList is a collection of Ingress.
message IngressList {
  // Standard object's metadata.

  optional string controller = 1;

  // parameters is a link to a custom resource containing additional
  // configuration for the controller. This is optional if the controller does
  // not require extra parameters.
  // +optional
  optional IngressClassParametersReference parameters = 2;
}

// IngressList is a collection of Ingress.
message IngressList {
  // Standard object's metadata.

  ./pilot/cmd/pilot-discovery \
  ./pkg/test/echo/cmd/client \
  ./pkg/test/echo/cmd/server \
  ./samples/extauthz/cmd/extauthz \
  ./operator/cmd/operator

# These are binaries that require Linux to build, and should
# be skipped on other platforms. Notably this includes the current Linux-only Istio CNI plugin
LINUX_AGENT_BINARIES:=./cni/cmd/istio-cni \
  ./cni/cmd/install-cni \
  $(AGENT_BINARIES)