// * webhooks that use this option may be reordered to minimize the number of additional invocations.
  // * to validate an object after all mutations are guaranteed complete, use a validating admission webhook instead.
  //
  // Defaults to "Never".
  // +optional
  optional string reinvocationPolicy = 10;

  // MatchConditions is a list of conditions that must be met for a request to be sent to this

            # e.g. UserInDB (containing hashed_password) could be a subclass of User
            # that doesn't have the hashed_password. But because it's a subclass, it
            # would pass the validation and be returned as is.
            # By being a new field, no inheritance will be passed as is. A new model
            # will always be created.
            # TODO: remove when deprecating Pydantic v1

}

// LimitResponse defines how to handle requests that can not be executed right now.
// +union
message LimitResponse {
  // `type` is "Queue" or "Reject".
  // "Queue" means that requests that can not be executed upon arrival
  // are held in a queue until they can be executed or a queuing limit
  // is reached.
  // "Reject" means that requests that can not be executed upon arrival
  // are rejected.
  // Required.

}

// LimitResponse defines how to handle requests that can not be executed right now.
// +union
message LimitResponse {
  // `type` is "Queue" or "Reject".
  // "Queue" means that requests that can not be executed upon arrival
  // are held in a queue until they can be executed or a queuing limit
  // is reached.
  // "Reject" means that requests that can not be executed upon arrival
  // are rejected.
  // Required.

     * OS family that can be tested for. {@value}
     */
    private static final String FAMILY_OS2 = "os/2";

    /**
     * OS family that can be tested for. {@value}
     */
    private static final String FAMILY_NETWARE = "netware";

    /**
     * OS family that can be tested for. {@value}
     */
    private static final String FAMILY_DOS = "dos";

    /**
     * OS family that can be tested for. {@value}
     */

  // This field is deprecated and will be removed in future api versions.
  // +optional
  map<string, string> topology = 5;

  // nodeName represents the name of the Node hosting this endpoint. This can
  // be used to determine endpoints local to a Node.
  // +optional
  optional string nodeName = 6;

  // hints contains information associated with how an endpoint should be
  // consumed.
  // +featureGate=TopologyAwareHints

// Kubelet uses this object to determine whether pod information needs to be passed on mount.
// CSIDriver objects are non-namespaced.
message CSIDriver {
  // Standard object metadata.
  // metadata.Name indicates the name of the CSI driver that this object
  // refers to; it MUST be the same name returned by the CSI GetPluginName()
  // call for that driver.
  // The driver name must be 63 characters or less, beginning and ending with

This is a security critical task: if the ztunnel can be bypassed, authorization policies can be bypassed.

Redirection must meet these requirements:
* All traffic *egressing* a pod in the mesh should be redirected to the node-local ztunnel on port 15001.
  * It is critical that this path preserves the Service IP, if the traffic was to a Service.

  // but not yet healthy can be evicted only if the guarded application is not
  // disrupted (status.currentHealthy is at least equal to status.desiredHealthy).
  // Healthy pods will be subject to the PDB for eviction.
  //
  // AlwaysAllow policy means that all running pods (status.phase="Running"),
  // but not yet healthy are considered disrupted and can be evicted regardless

  [[2]] Localhost (127.0.0.1) may also be unavailable if the whole
        network stack is offline.

  [[3]] "Remote" repositories referenced using the file:// protocol may
        be available. However, if that file:// url references a
        file-share, as in the case of an NFS or SMB mount, that will
        be unavailable.

  So, offline mode has several implications, some of which may not be
  altogether obvious: