// The number of pending and running pods.
  // +optional
  optional int32 active = 4;

  // The number of pods which reached phase Succeeded.
  // +optional
  optional int32 succeeded = 5;

  // The number of pods which reached phase Failed.
  // +optional
  optional int32 failed = 6;

  // completedIndexes holds the completed indexes when .spec.completionMode =

to the Waypoint proxy **after** applying any `TRANSPORT` layer policies (i.e. `Authorization`s). Thus, if the destination workload has at least the equivalent of a `STRICT` `PeerAuthentication`, unauthenticated traffic will be rejected before it reaches the Waypoint proxy. If the effective policy is `PERMISSIVE` (the default), the ztunnel will open a vanilla TLS HBONE tunnel (NOTE: this is not mTLS) to the Waypoint proxy and forward the traffic over that connection without presenting a client certificate....

// +union
message LimitResponse {
  // `type` is "Queue" or "Reject".
  // "Queue" means that requests that can not be executed upon arrival
  // are held in a queue until they can be executed or a queuing limit
  // is reached.
  // "Reject" means that requests that can not be executed upon arrival
  // are rejected.
  // Required.
  // +unionDiscriminator
  optional string type = 1;

// +union
message LimitResponse {
  // `type` is "Queue" or "Reject".
  // "Queue" means that requests that can not be executed upon arrival
  // are held in a queue until they can be executed or a queuing limit
  // is reached.
  // "Reject" means that requests that can not be executed upon arrival
  // are rejected.
  // Required.
  // +unionDiscriminator
  optional string type = 1;

  // container will eventually terminate within the Pod's termination grace
  // period (unless delayed by finalizers). Other management of the container blocks until the hook completes
  // or until the termination grace period is reached.
  // More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
  // +optional
  optional LifecycleHandler preStop = 2;
}

In addition to this conversion, `Ingress` requires writing the address it can be reached at in status. This is done by the Ingress Status controller.

#### Gateway

  // The server returns only those CIDRs that it thinks that the client can match.
  // For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP.
  // Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.
  // +optional

// +union
message LimitResponse {
  // `type` is "Queue" or "Reject".
  // "Queue" means that requests that can not be executed upon arrival
  // are held in a queue until they can be executed or a queuing limit
  // is reached.
  // "Reject" means that requests that can not be executed upon arrival
  // are rejected.
  // Required.
  // +unionDiscriminator
  optional string type = 1;

// +union
message LimitResponse {
  // `type` is "Queue" or "Reject".
  // "Queue" means that requests that can not be executed upon arrival
  // are held in a queue until they can be executed or a queuing limit
  // is reached.
  // "Reject" means that requests that can not be executed upon arrival
  // are rejected.
  // Required.
  // +unionDiscriminator
  optional string type = 1;