- periodically copy the K8S JWT token for istio-cni on the host to connect to K8S.
    - injects the CNI plugin config to the CNI config file
        - CNI installer will try to look for the config file under the mounted CNI net dir based on file name extensions (`.conf`, `.conflist`)
        - the file name can be explicitly set by `CNI_CONF_NAME` env var

// concepts during lookup stages without having partially valid types
//
// +protobuf.options.(gogoproto.goproto_stringer)=false
message GroupKind {
  optional string group = 1;

  optional string kind = 2;
}

// GroupResource specifies a Group and a Resource, but does not force a version.  This is useful for identifying
// concepts during lookup stages without having partially valid types
//

As the name suggests, an `Address` represents a particular IP Address.
This can be a `Service` or a `Workload`.

The address type has the following goals:
* It should support (but not require) on-demand lookups.
  * Specifically, ztunnel should be able to send a request to the control plane to answer "I got a request to send traffic to 1.1.1.1, what is 1.1.1.1?"

  // +listType=atomic
  repeated PodFailurePolicyRule rules = 1;
}

// PodFailurePolicyOnExitCodesRequirement describes the requirement for handling
// a failed pod based on its container exit codes. In particular, it lookups the
// .state.terminated.exitCode for each app container and init container status,
// represented by the .status.containerStatuses and .status.initContainerStatuses

If it is not possible or desirable to put the notice in a particular file,
then You may include the notice in a location (such as a LICENSE file in a
relevant directory) where a recipient would be likely to look for such a
notice.

You may add additional accurate notices of copyright ownership.

Exhibit B - "Incompatible With Secondary Licenses" Notice

      This Source Code Form is "Incompatible

  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // `items` is a list of FlowSchemas.
  repeated FlowSchema items = 2;
}

// FlowSchemaSpec describes how the FlowSchema's specification looks like.
message FlowSchemaSpec {
  // `priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot

  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // `items` is a list of FlowSchemas.
  repeated FlowSchema items = 2;
}

// FlowSchemaSpec describes how the FlowSchema's specification looks like.
message FlowSchemaSpec {
  // `priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot

### Relationship between the CLI and controller

The CLI and controller share the same API and codebase for generating manifests from the API. You can think of the
controller as the CLI command `istioctl install` running in a loop in a pod in the cluster and using the config
from the in-cluster IstioOperator custom resource (CR).
There are two major differences:

  // Duplicated nameservers will be removed.
  // +optional
  repeated string nameservers = 1;

  // A list of DNS search domains for host-name lookup.
  // This will be appended to the base search paths generated from DNSPolicy.
  // Duplicated search paths will be removed.
  // +optional
  repeated string searches = 2;

  // A list of DNS resolver options.

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // items is the list of CronJobs.
  repeated CronJob items = 2;
}

// CronJobSpec describes how the job execution will look like and when it will actually run.
message CronJobSpec {
  // The schedule in Cron format, see https://en.wikipedia.org/wiki/Cron.
  optional string schedule = 1;