repeated ValidatingWebhookConfiguration items = 2;
}

// WebhookClientConfig contains the information to make a TLS
// connection with the webhook
message WebhookClientConfig {
  // `url` gives the location of the webhook, in standard URL form
  // (`scheme://host:port/path`). Exactly one of `url` or `service`
  // must be specified.
  //
  // The `host` should not refer to a service running in the cluster; use

  repeated ValidatingWebhookConfiguration items = 2;
}

// WebhookClientConfig contains the information to make a TLS
// connection with the webhook
message WebhookClientConfig {
  // `url` gives the location of the webhook, in standard URL form
  // (`scheme://host:port/path`). Exactly one of `url` or `service`
  // must be specified.
  //
  // The `host` should not refer to a service running in the cluster; use

#-----------------------------------------------------------------------------
# Target: test
#-----------------------------------------------------------------------------

.PHONY: test

# This target sets JUNIT_REPORT to the location of the  go-junit-report binary.
# This binary is provided in the build container. If it is not found, the build
# container is not being used, so ask the user to install go-junit-report.

  // secret object contains more than one secret, all secrets are passed.
  // +featureGate=CSINodeExpandSecret
  // +optional
  optional SecretReference nodeExpandSecretRef = 10;
}

// Represents a source location of a volume to mount, managed by an external CSI driver
message CSIVolumeSource {
  // driver is the name of the CSI driver that handles this volume.
  // Consult with your admin for the correct name as registered in the cluster.

However, if a request needs a certain identity that we have not fetched yet, it will be immediately requested.

Ztunnel additionally will handle the rotation of these certificates (typically 24hr expiration) as they approach expiry.

## Telemetry

  // the time when allocation started.
  // +optional
  optional string driverName = 1;

  // Allocation is set by the resource driver once a resource or set of
  // resources has been allocated successfully. If this is not specified, the
  // resources have not been allocated yet.
  // +optional
  optional AllocationResult allocation = 2;

  // +required
  optional int32 perNodeHostBits = 2;

  // ipv4 defines an IPv4 IP block in CIDR notation(e.g. "10.0.0.0/8").
  // At least one of ipv4 and ipv6 must be specified.
  // This field is immutable.
  // +optional
  optional string ipv4 = 3;

  // ipv6 defines an IPv6 IP block in CIDR notation(e.g. "2001:db8::/64").
  // At least one of ipv4 and ipv6 must be specified.
  // This field is immutable.

  // presented as-is to a reader.
  // +optional
  optional string message = 2;

  // The field of the resource that has caused this error, as named by its JSON
  // serialization. May include dot and postfix notation for nested attributes.
  // Arrays are zero-indexed.  Fields may appear more than once in an array of
  // causes due to fields having multiple errors.
  // Optional.
  //
  // Examples:

    - **Pilot** - Responsible for configuring the proxies at runtime.

    - **Citadel** - Responsible for certificate issuance and rotation.

    - **Galley** - Responsible for validating, ingesting, aggregating, transforming and distributing config within Istio.

- **Operator** - The component provides user friendly options to operate the Istio service mesh.