* Specifically, ztunnel should be able to send a request to the control plane to answer "I got a request to send traffic to 1.1.1.1, what is 1.1.1.1?"
  * While this is not needed for small scales, this is important for the long tail of massive clusters (think 1 million endpoints), where the entire set of endpoints cannot reasonably be replicated to each ztunnel.
* It should not be client-specific.

`Generators` get as input the `Proxy` (a representation of the current client), the current `PushContext` snapshot, and a list of config updates that caused the change.

  // ---
  // Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
  // useful (see .node.status.conditions), the ability to deconflict is important.
  // The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
  // +required
  // +kubebuilder:validation:Required

  // value automatically if one of them is empty and the other is non-empty.
  // When namespace is specified in dataSourceRef,
  // dataSource isn't set to the same value and must be empty.
  // There are three important differences between dataSource and dataSourceRef:
  // * While dataSource only allows two specific types of objects, dataSourceRef
  //   allows any non-core object, as well as PersistentVolumeClaim objects.

- **Priority**. Each issue has a priority which is represented by the column in the [Prioritization](https://github.com/orgs/istio/projects/6) project. Priority can be one of
P0, P1, P2, or >P2. The priority indicates how important it is to address the issue within the milestone. P0 says that the
milestone cannot be considered achieved if the issue isn't resolved.

---

<div align="center">