return
    fi
  fi
  if [[ "${BUILD_ZTUNNEL_REPO:-}" == "" ]]; then
    return
  fi

  if ! which cargo; then
    echo "the rust toolchain (cargo, etc) is required for building ztunnel"
    return 1
  fi

  pushd "${BUILD_ZTUNNEL_REPO}"
  cargo build --profile="${BUILD_ZTUNNEL_PROFILE:-dev}" ${BUILD_ZTUNNEL_TARGET:+--target=${BUILD_ZTUNNEL_TARGET}}

  local ZTUNNEL_BIN_PATH

  // Warning messages describe a problem the client making the API request should correct or be aware of.
  // Limit warnings to 120 characters if possible.
  // Warnings over 256 characters and large numbers of warnings may be truncated.
  // +optional
  repeated string warnings = 7;
}

// AdmissionReview describes an admission review request/response.
message AdmissionReview {

* For large fixes (>100 LOC that’s not from generated files), SMEs from that area must also approve the PR.

## Bug Fixes

* Bug fixes will not be merged in until the first release has been published, unless it addresses a critical issue.
* All changes should have an associated GitHub issue and/or a release note.

    --mount "type=volume,source=gocache,destination=/gocache" \
    --mount "type=volume,source=cache,destination=/home/.cache" \
    --mount "type=volume,source=crates,destination=/home/.cargo/registry" \
    --mount "type=volume,source=git-crates,destination=/home/.cargo/git" \
    ${CONDITIONAL_HOST_MOUNTS} \

Since the domain certificates are stored in the gateway namespace, it is recommended to keep each
gateway in a dedicated namespace and restrict access.

For large-scale gateways it is optionally possible to use a dedicated pilot in the gateway namespace.

### Additional test templates

A number of helm test setups are general-purpose and should be installable in any cluster, to confirm

  // the list automatically by PodDisruptionBudget controller after some time.
  // If everything goes smooth this map should be empty for the most of the time.
  // Large number of entries in the map may indicate problems with pod deletions.
  // +optional
  map<string, k8s.io.apimachinery.pkg.apis.meta.v1.Time> disruptedPods = 2;

  // Number of pod disruptions that are currently allowed.

In the end, [after evaluation](https://docs.google.com/document/d/1c2123cKuYsBDpIon9FFdctWTUIMFweSjgwG7r8l3818/edit), the decision was to move forward with a Rust implementation.
This offered performance benefits that were too large to leave on the table, as well as opportunities to tune to our specific needs.

## Configuration protocol

Ztunnel, of course, needs to be dynamically configured in order to make decisions on how it should handle traffic.

  // allocation is to be attempted.
  // +optional
  optional string selectedNode = 1;

  // PotentialNodes lists nodes where the Pod might be able to run.
  //
  // The size of this field is limited to 128. This is large enough for
  // many clusters. Larger clusters may need more attempts to find a node
  // that suits all pending resources. This may get increased in the
  // future, but not reduced.
  //
  // +listType=set

may use multiple Gateways, each with a different load balancer IP, domains and certificates. Since the domain certificates are stored in the gateway namespace, it is recommended to keep each gateway in a dedicated namespace and restrict access. For large-scale gateways it is optionally possible to use a dedicated pilot in the gateway namespace. ### Additional test templates A number of helm test setups are general-purpose and should be installable in any cluster, to confirm Istio works properly and...

    [ -n "${JOB_NAME}" ] && [ -n "${BUILD_ID}" ]
    IN_PROW="$?"

    # Don't persist large diffs (30M+) on CI
    LARGE_FILE="$(find "${ARTIFACTS}" -name "${PATCH_NAME}" -type 'f' -size +30M)"
    if [ "${IN_PROW}" -eq 0 ] && [ -n "${LARGE_FILE}" ]; then
      rm "${PATCH_OUT}"
      echo "WARNING: patch file was too large to persist ($(du -h "${PATCH_OUT}"))"
      return 0
    fi