worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their

  // validity duration so a client must check the delta between the notBefore and
  // and notAfter fields in the issued certificate to determine the actual duration.
  //
  // The v1.22+ in-tree implementations of the well-known Kubernetes signers will
  // honor this field as long as the requested duration is not greater than the
  // maximum duration they will honor per the --cluster-signing-duration CLI

    - If excluded, ignore the pod and return prevResult
1. Setup redirect rules for the pods:
    - Get the port list from pods definition, as well as annotations.
    - Setup iptables with required port list: `nsenter --net=<k8s pod netns> /opt/cni/bin/istio-iptables ...`. Following conditions will prevent the redirect rules to be setup in the pods:

                                type: string
                              metric:
                                description: |-
                                  One of the well-known [Istio Standard Metrics](https://istio.io/latest/docs/reference/config/metrics/).

## Configuration protocol

Ztunnel, of course, needs to be dynamically configured in order to make decisions on how it should handle traffic.
For this purpose, we chose to use xDS transport protocol due to our expertise and existing infrastructure, and because the protocol is well suited to our needs.

this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
of the Software, and to permit persons to whom the Software is furnished to do
so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all

}

// RuntimeClassSpec is a specification of a RuntimeClass. It contains parameters
// that are required to describe the RuntimeClass to the Container Runtime
// Interface (CRI) implementation, as well as any other components that need to
// understand how the pod will be run. The RuntimeClassSpec is immutable.
message RuntimeClassSpec {
  // runtimeHandler specifies the underlying runtime and configuration that the

		return nil
	}
	w := table.NewStyleWriter(writer)
	w.SetAddRowFunc(func(obj interface{}) table.Row {
		wa := obj.(webhookAnalysis)
		row := table.Row{
			Cells: make([]table.Cell, 0),
		}
		row.Cells = append(row.Cells, table.NewCell(wa.Name), table.NewCell(wa.Revision))
		if wa.Injected {
			row.Cells = append(row.Cells, table.NewCell("✔", color.FgGreen))
		} else {

  // https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
  // Topology may include a maximum of 16 key/value pairs. This includes, but
  // is not limited to the following well known keys:
  // * kubernetes.io/hostname: the value indicates the hostname of the node
  //   where the endpoint is located. This should match the corresponding
  //   node label.

// K8S may get a pod Add event without any IPs in the object, and the pod will later be updated with IPs.
//
// We always need the IPs, but this is fine because this AddPodToMesh can be called from the CNI plugin as well,
// which always has the firsthand info of the IPs, even before K8S does - so we pass them separately here because
// we actually may have them before K8S in the Pod object.