optional string reason = 7;

  // regarding contains the object this Event is about. In most cases it's an Object reporting controller
  // implements, e.g. ReplicaSetController implements ReplicaSets and this event is emitted because
  // it acts on some changes in a ReplicaSet object.
  // +optional
  optional k8s.io.api.core.v1.ObjectReference regarding = 8;

  // This field IS NOT consulted in any way if "Allowed" is "true".
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Status status = 3;

  // The patch body. Currently we only support "JSONPatch" which implements RFC 6902.
  // +optional
  optional bytes patch = 4;

  // The type of Patch. Currently we only allow "JSONPatch".
  // +optional
  optional string patchType = 5;

option go_package = "k8s.io/api/apps/v1beta2";

// DEPRECATED - This group version of ControllerRevision is deprecated by apps/v1/ControllerRevision. See the
// release notes for more information.
// ControllerRevision implements an immutable snapshot of state data. Clients
// are responsible for serializing and deserializing the objects that contain
// their internal state.
// Once a ControllerRevision has been successfully created, it can not be updated.

  repeated CSIDriver items = 2;
}

// CSIDriverSpec is the specification of a CSIDriver.
message CSIDriverSpec {
  // attachRequired indicates this CSI volume driver requires an attach
  // operation (because it implements the CSI ControllerPublishVolume()
  // method), and that the Kubernetes attach detach controller should call
  // the attach volume interface which checks the volumeattachment status

  repeated string audiences = 4;

  // Error indicates that the token couldn't be checked
  // +optional
  optional string error = 3;
}

// UserInfo holds the information about the user needed to implement the
// user.Info interface.
message UserInfo {
  // The name that uniquely identifies this user among all active users.
  // +optional
  optional string username = 1;

    - if ambient is enabled, also runs an ambient controller, watching Pod, Namespace

- `istio-cni`
    - CNI plugin executable copied to `/opt/cni/bin`
    - currently implemented for k8s only
    - on pod add, determines whether pod should have netns setup to redirect to Istio proxy. See [cmdAdd](#cmdadd-workflow) for detailed logic.

  // This field IS NOT consulted in any way if "Allowed" is "true".
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Status status = 3;

  // The patch body. Currently we only support "JSONPatch" which implements RFC 6902.
  // +optional
  optional bytes patch = 4;

  // The type of Patch. Currently we only allow "JSONPatch".
  // +optional
  optional string patchType = 5;

  repeated CSIDriver items = 2;
}

// CSIDriverSpec is the specification of a CSIDriver.
message CSIDriverSpec {
  // attachRequired indicates this CSI volume driver requires an attach
  // operation (because it implements the CSI ControllerPublishVolume()
  // method), and that the Kubernetes attach detach controller should call
  // the attach volume interface which checks the volumeattachment status

#### Ingress

This document provides an overview of the architecture and design decisions around Ztunnel, the node-proxy component in ambient mode.

## Background and motivation

Motivations to implement ztunnel generally came from two areas.

First, and most importantly, it serves as a means to implement the real goal: waypoints.
For various reasons outside the scope of this document, there is a desire to move from a sidecar based architecture to a "remote proxy" architecture.