// can have their pods stopped for an update at any given time. The update
  // starts by stopping at most 30% of those DaemonSet pods and then brings
  // up new DaemonSet pods in their place. Once the new pods are available,
  // it then proceeds onto other DaemonSet pods, thus ensuring that at least
  // 70% of original number of DaemonSet pods are available at all times during
  // the update.

1. By running as a node-level daemonset that:

- listens for these UDS events from the CNI plugin (which fire when new pods are spawned in an ambient-enabled namespace), and adds those pods to the ambient mesh.
- watches k8s resource for existing pods, so that pods that have already been started can be moved in or out of the ambient mesh.

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // handler specifies the underlying runtime and configuration that the CRI
  // implementation will use to handle pods of this class. The possible values
  // are specific to the node & CRI configuration.  It is assumed that all
  // handlers are available on every node, and handlers of the same name are
  // equivalent on every node.

  // value represents the integer value of this priority class. This is the actual priority that pods
  // receive when they have the name of this class in their pod spec.
  optional int32 value = 2;

  // globalDefault specifies whether this PriorityClass should be considered as
  // the default priority for pods that do not have any priority class.
  // Only one PriorityClass can be marked as `globalDefault`. However, if more than

  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind kind = 2;

  // Resource is the fully-qualified resource being requested (for example, v1.pods)
  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource resource = 3;

  // SubResource is the subresource being requested, if any (for example, "status" or "scale")
  // +optional

  // all pods within the namespace.
  // +patchStrategy=replace
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;

  // An eviction is allowed if at most "maxUnavailable" pods selected by
  // "selector" are unavailable after the eviction, i.e. even in absence of
  // the evicted pod. For example, one can prevent all voluntary evictions

  optional string completionMode = 9;

  // suspend specifies whether the Job controller should create Pods or not. If
  // a Job is created with suspend set to true, no Pods are created by the Job
  // controller. If a Job is suspended after creation (i.e. the flag goes from
  // false to true), the Job controller will delete all active Pods associated
  // with this Job. Users must design their workload to gracefully handle this.

message NetworkPolicyPeer {
  // podSelector is a label selector which selects pods. This field follows standard label
  // selector semantics; if present but empty, it selects all pods.
  //
  // If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects
  // the pods matching podSelector in the Namespaces selected by NamespaceSelector.
  // Otherwise it selects the pods matching podSelector in the policy's own namespace.
  // +optional

  repeated string apiVersions = 2;

  // Resources is a list of resources this rule applies to.
  //
  // For example:
  // 'pods' means pods.
  // 'pods/log' means the log subresource of pods.
  // '*' means all resources, but not subresources.
  // 'pods/*' means all subresources of pods.
  // '*/scale' means all scale subresources.
  // '*/*' means all resources and their subresources.
  //

  // if a fstype is defined and the volume's access mode contains ReadWriteOnce.
  //
  // +optional
  optional string fsGroupPolicy = 5;

  // tokenRequests indicates the CSI driver needs pods' service account
  // tokens it is mounting volume for to do necessary authentication. Kubelet
  // will pass the tokens in VolumeContext in the CSI NodePublishVolume calls.