## Privileges required

  // CSI specification and implemented in Kubernetes via the usual PV/PVC mechanism.
  //
  // The other mode is "Ephemeral". In this mode, volumes are defined inline inside the pod spec
  // with CSIVolumeSource and their lifecycle is tied to the lifecycle of that pod.
  // A driver has to be aware of this because it is only going to get a NodePublishVolume call for such a volume.
  //

  // CSI specification and implemented in Kubernetes via the usual PV/PVC mechanism.
  //
  // The other mode is "Ephemeral". In this mode, volumes are defined inline inside the pod spec
  // with CSIVolumeSource and their lifecycle is tied to the lifecycle of that pod.
  // A driver has to be aware of this because it is only going to get a NodePublishVolume call for such a volume.
  //

}

// ExecAction describes a "run in container" action.
message ExecAction {
  // Command is the command line to execute inside the container, the working directory for the
  // command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
  // not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
  // a shell, you need to explicitly call out to that shell.

apps may target different 'environments' which contain different instances and variants of Istio.

- Better security: separate Istio components reside in different namespaces, allowing different teams or
roles to manage different parts of Istio. For example, a security team would maintain the
root CA and policy, a telemetry team may only have access to Prometheus,

  optional string group = 8;

  // version is the preferred version of the resource.  Empty implies the version of the containing resource list
  // For subresources, this may have a different value, for example: v1 (while inside a v1beta1 version of the core resource's group)".
  optional string version = 9;

  // kind is the kind for the resource (e.g. 'Foo' is the kind for a resource 'foo')
  optional string kind = 3;

// in future we may allow also inline volumes in pods.
// Exactly one member can be set.
message VolumeAttachmentSource {
  // persistentVolumeName represents the name of the persistent volume to attach.
  // +optional
  optional string persistentVolumeName = 1;

  // inlineVolumeSpec contains all the information necessary to attach
  // a persistent volume defined by a pod's inline VolumeSource. This field

//
// // Internal package:
//
// 	type MyAPIObject struct {
// 		runtime.TypeMeta `json:",inline"`
// 		MyPlugin runtime.Object `json:"myPlugin"`
// 	}
//
// 	type PluginA struct {
// 		AOption string `json:"aOption"`
// 	}
//
// // External package:
//
// 	type MyAPIObject struct {
// 		runtime.TypeMeta `json:",inline"`
// 		MyPlugin runtime.RawExtension `json:"myPlugin"`
// 	}
//
// 	type PluginA struct {

listener/main_internal           0     ALL   Cluster: encap
listener/main_internal           0     ALL   Cluster: encap
listener/              0.0.0.0   15021 ALL   Inline Route: /healthz/ready*

NAME                                                              VHOST NAME            DOMAINS     MATCH     VIRTUAL SERVICE

However, there is also a bit of additional logic. Gateway types have extensive status reporting. Unlike Ingress, this is status reporting is done inline in the main controller, allowing status generation to be done directly in the logic processing the resources.

Additionally, Gateway involves two components writing to the cluster: