optional int64 observedGeneration = 1;

  // replicas is the number of Pods created by the StatefulSet controller.
  optional int32 replicas = 2;

  // readyReplicas is the number of pods created by this StatefulSet controller with a Ready Condition.
  optional int32 readyReplicas = 3;

  // currentReplicas is the number of Pods created by the StatefulSet controller from the StatefulSet version
  // indicated by currentRevision.

    - `istio-cni-config` configmap with CNI plugin config to add to CNI plugin chained config
    - creates service-account `istio-cni` with `ClusterRoleBinding` to allow gets on pods' info and delete/modifications for recovery.

- `install-cni` container
    - copies `istio-cni` and `istio-iptables` to `/opt/cni/bin`
    - creates kubeconfig for the service account the pod runs under

  // skips updates for the Job.
  // +optional
  optional string completionMode = 9;

  // suspend specifies whether the Job controller should create Pods or not. If
  // a Job is created with suspend set to true, no Pods are created by the Job
  // controller. If a Job is suspended after creation (i.e. the flag goes from
  // false to true), the Job controller will delete all active Pods associated

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastSuccessfulTime = 5;
}

// JobTemplateSpec describes the data a Job should have when created from a template
message JobTemplateSpec {
  // Standard object's metadata of the jobs created from this template.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional

To install with Helm, you must first create the namespace that you wish to install in if the namespace does not exist already. The default namespace used is `istio-system` and can be created as follows:

```console
kubectl create namespace istio-system
```

Istio's helm charts come with a common `openshift` profile that can be used during installation.

1. Set env $WATCH_NAMESPACE (default value is "istio-system") and $LEADER_ELECTION_NAMESPACE (default value is "istio-operator")

1. Create the `WATCH_NAMESPACE` and `LEADER_ELECTION_NAMESPACE` if they are not created yet.

```bash
kubectl create ns $WATCH_NAMESPACE --dry-run -o yaml | kubectl apply -f -
kubectl create ns $LEADER_ELECTION_NAMESPACE --dry-run -o yaml | kubectl apply -f -
```

  // +optional
  optional int64 observedGeneration = 1;

  // replicas is the number of Pods created by the StatefulSet controller.
  optional int32 replicas = 2;

  // readyReplicas is the number of pods created for this StatefulSet with a Ready Condition.
  optional int32 readyReplicas = 3;

  // currentReplicas is the number of Pods created by the StatefulSet controller from the StatefulSet version
  // indicated by currentRevision.

}

// ResourceClaimSpec defines how a resource is to be allocated.
message ResourceClaimSpec {
  // ResourceClassName references the driver and additional parameters
  // via the name of a ResourceClass that was created as part of the
  // driver deployment.
  optional string resourceClassName = 1;

  // ParametersRef references a separate object with arbitrary parameters

  // +listType=atomic
  repeated string usages = 5;

  // username contains the name of the user that created the CertificateSigningRequest.
  // Populated by the API server on creation and immutable.
  // +optional
  optional string username = 2;

  // uid contains the uid of the user that created the CertificateSigningRequest.
  // Populated by the API server on creation and immutable.
  // +optional

  // The RuntimeClass admission controller will reject Pod create requests which have the overhead already
  // set. If RuntimeClass is configured and selected in the PodSpec, Overhead will be set to the value
  // defined in the corresponding RuntimeClass, otherwise it will remain unset and treated as zero.