// a persistent volume defined by a pod's inline VolumeSource. This field
  // is populated only for the CSIMigration feature. It contains
  // translated fields from a pod's inline VolumeSource to a
  // PersistentVolumeSpec. This field is beta-level and is only
  // honored by servers that enabled the CSIMigration feature.
  // +optional
  optional k8s.io.api.core.v1.PersistentVolumeSpec inlineVolumeSpec = 2;
}

// a Pod with ResourceClaims that use "WaitForFirstConsumer" allocation
// mode.
//
// This is an alpha type and requires enabling the DynamicResourceAllocation
// feature gate.
message PodSchedulingContext {
  // Standard object metadata
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec describes where resources for the Pod are needed.

  // a persistent volume defined by a pod's inline VolumeSource. This field
  // is populated only for the CSIMigration feature. It contains
  // translated fields from a pod's inline VolumeSource to a
  // PersistentVolumeSpec. This field is alpha-level and is only
  // honored by servers that enabled the CSIMigration feature.
  // +optional
  optional k8s.io.api.core.v1.PersistentVolumeSpec inlineVolumeSpec = 2;
}

  // built in to Kubernetes, and have special scaling options on top of those
  // available to normal per-pod metrics using the "pods" source.
  // This is an alpha feature and can be enabled by the HPAContainerMetrics feature flag.
  // +optional
  optional ContainerResourceMetricSource containerResource = 7;

  // external refers to a global metric that is not associated

  // built in to Kubernetes, and have special scaling options on top of those
  // available to normal per-pod metrics using the "pods" source.
  // This is an alpha feature and can be enabled by the HPAContainerMetrics feature flag.
  // +optional
  optional ContainerResourceMetricSource containerResource = 7;

  // external refers to a global metric that is not associated

  //      - If failurePolicy=Fail, reject the request
  //      - If failurePolicy=Ignore, the error is ignored and the webhook is skipped
  //
  // This is an alpha feature and managed by the AdmissionWebhookMatchConditions feature gate.
  //
  // +patchMergeKey=name
  // +patchStrategy=merge
  // +listType=map
  // +listMapKey=name
  // +featureGate=AdmissionWebhookMatchConditions
  // +optional

  * This puts a much tighter budget on CPU, memory, latency, and throughput requirements than traditional Istio sidecars.

Ztunnel was not designed to be a feature-rich data plane.
Quite the opposite - an *aggressively* small feature set is the key feature that makes ztunnel viable.
It very intentionally does not offer L7 (HTTP) functionality, for instance, which would likely violate some of the goals above, without contributing to them.

  // a persistent volume defined by a pod's inline VolumeSource. This field
  // is populated only for the CSIMigration feature. It contains
  // translated fields from a pod's inline VolumeSource to a
  // PersistentVolumeSpec. This field is beta-level and is only
  // honored by servers that enabled the CSIMigration feature.
  // +optional
  optional k8s.io.api.core.v1.PersistentVolumeSpec inlineVolumeSpec = 2;
}

  //      - If failurePolicy=Fail, reject the request
  //      - If failurePolicy=Ignore, the error is ignored and the webhook is skipped
  //
  // This is an alpha feature and managed by the AdmissionWebhookMatchConditions feature gate.
  //
  // +patchMergeKey=name
  // +patchStrategy=merge
  // +listType=map
  // +listMapKey=name
  // +featureGate=AdmissionWebhookMatchConditions
  // +optional

  // If specified, the node's taints.
  // +optional
  repeated Taint taints = 5;

  // Deprecated: Previously used to specify the source of the node's configuration for the DynamicKubeletConfig feature. This feature is removed.
  // +optional
  optional NodeConfigSource configSource = 6;

  // Deprecated. Not all kubelets will set this field. Remove field after 1.13.
  // see: https://issues.k8s.io/61966