// or mis-configured policy definitions or bindings.
  //
  // A policy is invalid if spec.paramKind refers to a non-existent Kind.
  // A binding is invalid if spec.paramRef.name refers to a non-existent resource.
  //
  // failurePolicy does not define how validations that evaluate to false are handled.
  //

  // Version is the API Version of the Resource.  "*" means all.
  // +optional
  optional string version = 4;

  // Resource is one of the existing resource types.  "*" means all.
  // +optional
  optional string resource = 5;

  // Subresource is one of the existing resource types.  "" means none.
  // +optional
  optional string subresource = 6;

  // RuntimeClass. Pods using this RuntimeClass can only be scheduled to a
  // node matched by this selector. The RuntimeClass nodeSelector is merged
  // with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional
  // +mapType=atomic
  map<string, string> nodeSelector = 1;

  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template
  optional k8s.io.api.core.v1.PodTemplateSpec template = 2;

  // An update strategy to replace existing DaemonSet pods with new pods.
  // +optional
  optional DaemonSetUpdateStrategy updateStrategy = 3;

  // The minimum number of seconds for which a newly created DaemonSet pod should

// with time.  Event consumers should not rely on the timing of an event
// with a given Reason reflecting a consistent underlying trigger, or the
// continued existence of events with that Reason.  Events should be
// treated as informative, best-effort, supplemental data.
message Event {
  // Standard object's metadata.

  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastUpdateTime = 4;

  // lastTransitionTime is the time the condition last transitioned from one status to another.
  // If unset, when a new condition type is added or an existing condition's status is changed,
  // the server defaults this to the current time.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 5;
}

message CertificateSigningRequestList {

  // Object is the object from the incoming request.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension object = 9;

  // OldObject is the existing object. Only populated for DELETE and UPDATE requests.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension oldObject = 10;

- listens for these UDS events from the CNI plugin (which fire when new pods are spawned in an ambient-enabled namespace), and adds those pods to the ambient mesh.
- watches k8s resource for existing pods, so that pods that have already been started can be moved in or out of the ambient mesh.

and understand each binary that gets deployed, and select which combination to use.

Note: each component can be installed in parallel with an existing Istio 1.0 or 1.1 installation in
`istio-system`. The new components will not interfere with existing apps, but can interoperate,
and it is possible to gradually move apps from Istio 1.0/1.1 to the new environments and
across environments ( for example canary -> prod )

## Goals

Ztunnel should:
* **Not break users**. This means that deploying Ztunnel should retain all existing Kubernetes behavior.
  * This includes UDP, non-compliant HTTP, server-first protocols, stateful sets, external services, etc.