eventually someone will want to customize every one of those fields.
If all fields are exposed in `values.yaml`, we end up with an massive API that is also likely worse than just using the Kubernetes API directly.

To avoid this, the project attempts to minimize additions to the `values.yaml` API where possible.

  map<string, string> selector = 2;

  // label selector for pods that should match the replicas count. This is a serializated
  // version of both map-based and more expressive set-based selectors. This is done to
  // avoid introspection in the clients. The string will be in the same format as the
  // query-param syntax. If the target type only supports map-based selectors, both this
  // field and map-based selector field are populated.

lintconfig.gen.json
.istiorc
.istiorc.mk
# codegen stuff
bin/adapterlinter
bin/protoc-gen-gogoslick*
bin/protoc-min-version*
bin/protoc-gen-docs*
bin/testlinter
bin/envvarlinter
bin/istioctl
*.orig
# Avoid accidental istio.VERSION changes
istio.VERSION
LICENSES.txt
# Proxy generated proxy config in integration test
tests/integration/component/proxy/envoy.conf
**/var/run/secrets/
# Certs generated by testing

RELEASE_LDFLAGS='-extldflags -static -s -w'
endif

# List of all binaries to build
# We split the binaries into "agent" binaries and standard ones. This corresponds to build "agent".
# This allows conditional compilation to avoid pulling in costly dependencies to the agent, such as XDS and k8s.
AGENT_BINARIES:=./pilot/cmd/pilot-agent
STANDARD_BINARIES:=./istioctl/cmd/istioctl \
  ./pilot/cmd/pilot-discovery \
  ./pkg/test/echo/cmd/client \

  optional string devicePath = 2;
}

// AvoidPods describes pods that should avoid this node. This is the value for a
// Node annotation with key scheduler.alpha.kubernetes.io/preferAvoidPods and
// will eventually become a field of NodeStatus.
message AvoidPods {
  // Bounded-sized list of signatures of pods that should avoid this node, sorted
  // in timestamp order from oldest to newest. Size of the slice is unspecified.

Various components described in Config Ingestion can trigger a Config Update. These are batched up ("debounced"), to avoid excessive activity when many changes happen in succession, and eventually enqueued in the Push Queue.

  optional string version = 2;
}

// GroupVersionKind unambiguously identifies a kind.  It doesn't anonymously include GroupVersion
// to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
//
// +protobuf.options.(gogoproto.goproto_stringer)=false
message GroupVersionKind {
  optional string group = 1;

  optional string version = 2;

  map<string, string> selector = 2;

  // label selector for pods that should match the replicas count. This is a serializated
  // version of both map-based and more expressive set-based selectors. This is done to
  // avoid introspection in the clients. The string will be in the same format as the
  // query-param syntax. If the target type only supports map-based selectors, both this
  // field and map-based selector field are populated.

  // as a prefix of allowed sysctls. Single * means all unsafe sysctls are allowed.
  // Kubelet has to allowlist all allowed unsafe sysctls explicitly to avoid rejection.
  //
  // Examples:
  // e.g. "foo/*" allows "foo/bar", "foo/baz", etc.
  // e.g. "foo.*" allows "foo.bar", "foo.baz", etc.
  // +optional
  repeated string allowedUnsafeSysctls = 19;

  optional int32 replicas = 1;

  // selector is the label query over pods that should match the replicas count. This is same
  // as the label selector but in the string format to avoid introspection
  // by clients. The string will be in the same format as the query-param syntax.
  // More info about label selectors: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  // +optional