// a ready endpoint that is terminating. If nil, consumers should defer to
  // the ready condition.
  // +optional
  optional bool serving = 2;

  // terminating indicates that this endpoint is terminating. A nil value
  // indicates an unknown state. Consumers should interpret this unknown state
  // to mean that the endpoint is not terminating.
  // +optional
  optional bool terminating = 3;

  // a ready endpoint that is terminating. If nil, consumers should defer to
  // the ready condition.
  // +optional
  optional bool serving = 2;

  // terminating indicates that this endpoint is terminating. A nil value
  // indicates an unknown state. Consumers should interpret this unknown state
  // to mean that the endpoint is not terminating.
  // +optional

// Event is a report of an event somewhere in the cluster. It generally denotes some state change in the system.
// Events have a limited retention time and triggers and messages may evolve
// with time.  Event consumers should not rely on the timing of an event
// with a given Reason reflecting a consistent underlying trigger, or the
// continued existence of events with that Reason.  Events should be

  // deallocated.
  //
  // The driver then must deallocate this claim and reset the field
  // together with clearing the Allocation field.
  //
  // While DeallocationRequested is set, no new consumers may be added to
  // ReservedFor.
  // +optional
  optional bool deallocationRequested = 4;
}

// ResourceClaimTemplate is used to produce ResourceClaim objects.
message ResourceClaimTemplate {

// Event is a report of an event somewhere in the cluster. It generally denotes some state change in the system.
// Events have a limited retention time and triggers and messages may evolve
// with time.  Event consumers should not rely on the timing of an event
// with a given Reason reflecting a consistent underlying trigger, or the
// continued existence of events with that Reason.  Events should be

  // use a full-replacement patch. See https://pr.k8s.io/79391 for an example.
  // Consumers should assume that addresses can change during the
  // lifetime of a Node. However, there are some exceptions where this may not
  // be possible, such as Pods that inherit a Node's address in its own status or
  // consumers of the downward API (status.hostIP).
  // +optional
  // +patchMergeKey=type
  // +patchStrategy=merge

  // reason (Ready transitions to false, is evicted, or is drained) an updated
  // pod is immediatedly created on that node without considering surge limits.
  // Allowing surge implies the possibility that the resources consumed by the
  // daemonset on any given node can double if the readiness check fails, and
  // so resource intensive daemonsets should take into account that they may
  // cause evictions during disruption.
  // +optional

A secondary goal was to enable a smoother on-ramp from "Zero" to "Getting some value".
Historically, Istio had to really be consumed all-or-nothing for things to work as expected.
In particular, an easy answer to "I just want to have mTLS everywhere, then I can think about adopting the rest of service mesh" was desired.

## Goals

Ztunnel should:

  optional k8s.io.apimachinery.pkg.util.intstr.IntOrString maxUnavailable = 3;

  // UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods
  // should be considered for eviction. Current implementation considers healthy pods,
  // as pods that have status.conditions item with type="Ready",status="True".
  //
  // Valid policies are IfHealthyBudget and AlwaysAllow.
  // If no policy is specified, the default behavior will be used,

// - such an object exists, but the capacity is unset
// - such an object exists, but the capacity is zero
//
// The producer of these objects can decide which approach is more suitable.
//
// They are consumed by the kube-scheduler when a CSI driver opts into
// capacity-aware scheduling with CSIDriverSpec.StorageCapacity. The scheduler
// compares the MaximumVolumeSize against the requested size of pending volumes