// deprecatedTopology contains topology information part of the v1beta1
  // API. This field is deprecated, and will be removed when the v1beta1
  // API is removed (no sooner than kubernetes v1.24).  While this field can
  // hold values, it is not writable through the v1 API, and any attempts to
  // write to it will be silently ignored. Topology information can be found

  // This field does not guarantee that the pod will be scheduled on this node. Scheduler may decide
  // to place the pod elsewhere if other nodes become available sooner. Scheduler may also decide to
  // give the resources on this node to a higher priority pod that is created after preemption.
  // As a result, this field may be different than PodSpec.nodeName when the pod is
  // scheduled.

* Simple object filtering. Beyond just static filters on objects, `kclient` supports _dynamic filters_ that can change at runtime.
  When a filter changes and includes/removes new objects, those are automatically handled.
* Proper syncing and shutdown logic. Checking for when an informer has fully started can be quite tricky; `kclient` automatically handles it.

fork of the Istio helm templates, refactored to increase modularity and isolation.

Goals:
- Improve upgrade experience: users should be able to gradually roll upgrades, with proper
canary deployments for Istio components. It should be possible to deploy a new version while keeping the
stable version in place and gradually migrate apps to the new version.

### Overview

- [istio-cni Helm chart](../manifests/charts/istio-cni/templates)
    - `install-cni` daemonset - main function is to install and help the node CNI, but it is also a proper server and interacts with K8S, watching Pods for recovery.
    - `istio-cni-config` configmap with CNI plugin config to add to CNI plugin chained config

  //
  // TODO: Determine how to detect ContentType and ContentEncoding of 'Raw' data.
  optional bytes raw = 1;
}

// TypeMeta is shared by all top level objects. The proper way to use it is to inline it in your type,
// like this:
//
// 	type MyAwesomeAPIObject struct {
// 	     runtime.TypeMeta    `json:",inline"`
// 	     ... // other fields
// 	}
//

1. The `caClient` will be configured to use either JWT or mTLS authentication. For JWT authentication, gRPC's `PerRPCCredentials`
   is configured with a `TokenProvider` which handles the logic of adding the proper JWT to each request. mTLS is configured
   by a tls.Config that points to files on disk.

It should be noted there is a circular dependency with mTLS authentication; in order to fetch a certificate we need