// Node.  A ClusterCIDR is eligible to be used for a given Node when the node
// selector matches the node in question and has free CIDRs to allocate.  In
// case of multiple matching ClusterCIDR resources, the allocator will attempt
// to break ties using internal heuristics, but any ClusterCIDR whose node
// selector matches the Node may be used.
message ClusterCIDR {
  // Standard object's metadata.

  // +optional
  optional string hostIP = 5;

  // IP address allocated to the pod. Routable at least within the cluster.
  // Empty if not yet allocated.
  // +optional
  optional string podIP = 6;

  // podIPs holds the IP addresses allocated to the pod. If this field is specified, the 0th entry must
  // match the podIP field. Pods may be allocated at most 1 value for each of IPv4 and IPv6. This list

  // allocated for.
  //
  // The size of this field is limited to 128, the same as for
  // PodSchedulingSpec.PotentialNodes. This may get increased in the
  // future, but not reduced.
  //
  // +listType=set
  // +optional
  repeated string unsuitableNodes = 2;
}

// ResourceClaimSpec defines how a resource is to be allocated.
message ResourceClaimSpec {

  meshConfig:
    enablePrometheusMerge: true

  experimental:
    stableValidationPolicy: false

  global:
    # Used to locate istiod.
    istioNamespace: istio-system
    # List of cert-signers to allow "approve" action in the istio cluster role
    #
    # certSigners:
    #   - clusterissuers.cert-manager.io/istio-ca
    certSigners: []

				}
				pl, err := client.PodsForSelector(context.TODO(), ctx.NamespaceOrDefault(ctx.IstioNamespace()), istiodLabelSelector)
				if err != nil {
					return fmt.Errorf("not able to locate pod with selector %s: %v", istiodLabelSelector, err)
				}

				if len(pl.Items) < 1 {
					return errors.New("no pods found")
				}

				if len(pl.Items) > 1 {

import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";

// Package-wide variables from generator "generated".
option go_package = "k8s.io/api/rbac/v1";

// AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
message AggregationRule {
  // ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.

' | kubectl apply --kubeconfig="$KUBECONFIG" -f -

}

function cidr_to_ips() {
    CIDR="$1"
    # cidr_to_ips returns a list of single IPs from a CIDR. We skip 1000 (since they are likely to be allocated
    # already to other services), then pick the next 100.
    python3 - <<EOF
from ipaddress import ip_network, IPv6Network;
from itertools import islice;

net = ip_network('$CIDR')

		podNames []string
		ns       string
	)
	pl, err := kubeClient.PodsForSelector(context.TODO(), ctx.NamespaceOrDefault(ctx.Namespace()), labelSelector)
	if err != nil {
		return nil, "", fmt.Errorf("not able to locate pod with selector %s: %v", labelSelector, err)
	}
	if len(pl.Items) < 1 {
		return nil, "", errors.New("no pods found")
	}
	for _, pod := range pl.Items {
		podNames = append(podNames, pod.Name)
	}

  // IP address of the host to which the carp is assigned. Empty if not yet scheduled.
  // +optional
  optional string hostIP = 5;

  // IP address allocated to the carp. Routable at least within the cluster.
  // Empty if not yet allocated.
  // +optional
  optional string carpIP = 6;

  // RFC 3339 date and time at which the object was acknowledged by the Kubelet.

    # to use for pulling any images in pods that reference this ServiceAccount.
    # Must be set for any cluster configured with private docker registry.
    imagePullSecrets: []

    # Used to locate istiod.
    istioNamespace: istio-system

    externalIstiod: false
    remotePilotAddress: ""

    # Platform where Istio is deployed. Possible values are: "openshift", "gcp".