you get all CRDs.  CRDs are separated by release and by component type in the CRD directory.

Istio has strong integration with certmanager.  Some operators may want to keep their current certmanager
CRDs in place and not have Istio modify them. In this case, it is necessary to apply CRD files individually.

```bash
kubectl apply -k github.com/istio/installer/base
```

## Step 3. Update istioctl schema

Istioctl uses a [schema](../../operator/pkg/apis/istio/v1alpha1/values_types.proto) to validate the values. Any changes to
the schema must be added here, otherwise istioctl users will see errors.
Once the schema file is updated, run:

```bash
$ make operator-proto
```

This will regenerate the Go structs used for schema validation.

// relates the key and values.
message LabelSelectorRequirement {
  // key is the label key that the selector applies to.
  // +patchMergeKey=key
  // +patchStrategy=merge
  optional string key = 1;

  // operator represents a key's relationship to a set of values.
  // Valid operators are In, NotIn, Exists and DoesNotExist.
  optional string operator = 2;

// the triple <key,value,effect> using the matching operator <operator>.
message Toleration {
  // Key is the taint key that the toleration applies to. Empty means match all taint keys.
  // If the key is empty, operator must be Exists; this combination means to match all values and all keys.
  // +optional
  optional string key = 1;

  // Operator represents a key's relationship to the value.

  optional string scope = 4;
}

// RuleWithOperations is a tuple of Operations and Resources. It is recommended to make
// sure that all the tuple expansions are valid.
message RuleWithOperations {
  // Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or *
  // for all of those operations and any future admission operations that are added.
  // If '*' is present, the length of the slice must be one.

  // react to an unknown operator by assuming the requirement is not satisfied.
  optional string operator = 2;

  // Specifies the set of values. Each returned container exit code (might be
  // multiple in case of multiple containers) is checked against this set of
  // values with respect to the operator. The list of values must be ordered

meeting to share your ideas.

This document is an overview of how the operator works from a user perspective. For more details about the design and
architecture and a code overview, see [ARCHITECTURE.md](../architecture/environments/operator.md).

## Introduction

The operator uses the [IstioOperator API](https://github.com/istio/api/blob/master/operator/v1alpha1/operator.proto), which has
three main components:

  // associated with "runlevel" of "0" or "1";  you will set the selector as
  // follows:
  // "namespaceSelector": {
  //   "matchExpressions": [
  //     {
  //       "key": "runlevel",
  //       "operator": "NotIn",
  //       "values": [
  //         "0",
  //         "1"
  //       ]
  //     }
  //   ]
  // }
  //
  // If instead you want to only run the webhook on any objects whose

Requests leaving a pod go through the "outbound" code path on port 15001.
This is where most of Ztunnel's logic lives.

For outbound traffic, we need to first determine where the traffic is destined to.
As Ztunnel operates at L4, we only have the destination IP/port (recovered via `SO_ORIGINAL_DST`).
This may be an IP of a Service, a Pod, or something outside the cluster.

  //
  // +optional
  optional bool attachRequired = 1;

  // podInfoOnMount indicates this CSI volume driver requires additional pod information (like podName, podUID, etc.)
  // during mount operations, if set to true.
  // If set to false, pod information will not be passed on mount.
  // Default is false.
  //
  // The CSI driver specifies podInfoOnMount as part of driver deployment.