// different than the options the caller provided. e.g. for a patch request the performed
  // Operation might be a CREATE, in which case the Options will a
  // `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension options = 12;
}

// AdmissionResponse describes an admission response.

  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
  // +optional
  optional string evaluationError = 3;
}

The ambient CNI agent is the only place where ambient network config and pod redirection machinery happens.

  * Explicitly opting into behavioral changes can be acceptable. For example, introducing Istio multi-cluster semantics.
* Ensure traffic between mesh workloads is securely encrypted with an Istio identity.
* Be lightweight enough to not limit adoption.
  * This puts a much tighter budget on CPU, memory, latency, and throughput requirements than traditional Istio sidecars.

Ztunnel was not designed to be a feature-rich data plane.

  // a direct binding between Ingress controller and Ingress resources. Newly
  // created Ingress resources should prefer using the field. However, even
  // though the annotation is officially deprecated, for backwards compatibility
  // reasons, ingress controllers should still honor that annotation if present.
  // +optional
  optional string ingressClassName = 4;

// kubelet plugin registration.
// CSINode has the same name as a node. If the object is missing, it means either
// there are no CSI Drivers available on the node, or the Kubelet version is low
// enough that it doesn't create this object.
// CSINode has an OwnerReference that points to the corresponding node object.
message CSINode {
  // metadata.name must be the Kubernetes node name.

  // +optional
  optional string selectedNode = 1;

  // PotentialNodes lists nodes where the Pod might be able to run.
  //
  // The size of this field is limited to 128. This is large enough for
  // many clusters. Larger clusters may need more attempts to find a node
  // that suits all pending resources. This may get increased in the
  // future, but not reduced.
  //
  // +listType=set
  // +optional

  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
  // +optional
  optional string evaluationError = 3;
}

  optional MetricValueStatus current = 2;

  // container is the name of the container in the pods of the scaling target
  optional string container = 3;
}

// CrossVersionObjectReference contains enough information to let you identify the referred resource.
message CrossVersionObjectReference {

  // container is the name of the container in the pods of the scaling target
  optional string container = 4;
}

// CrossVersionObjectReference contains enough information to let you identify the referred resource.
message CrossVersionObjectReference {
  // Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds