// The webhook cares about an operation if it matches _any_ Rule.
  // However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
  // from putting the cluster in a state which cannot be recovered from without completely
  // disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called

  // The webhook cares about an operation if it matches _any_ Rule.
  // However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
  // from putting the cluster in a state which cannot be recovered from without completely
  // disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called

* It should not be client-specific.
  * In Istio sidecars, historically we had a lot of client-specific xDS. For example, putting the xDS-client's IP back into the xDS response. This makes efficient control plane implementation (most notably, caching), extremely challenging.

  // +optional
  optional PodAffinity podAffinity = 2;

  // Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
  // +optional
  optional PodAntiAffinity podAntiAffinity = 3;
}

// AttachedVolume describes a volume attached to a node
message AttachedVolume {