// HPAContainerMetrics is enabled
  optional string type = 1;

  // object refers to a metric describing a single kubernetes object
  // (for example, hits-per-second on an Ingress object).
  // +optional
  optional ObjectMetricSource object = 2;

  // pods refers to a metric describing each pod in the current scale target
  // (for example, transactions-processed-per-second).  The values will be

  // HPAContainerMetrics is enabled
  optional string type = 1;

  // object refers to a metric describing a single kubernetes object
  // (for example, hits-per-second on an Ingress object).
  // +optional
  optional ObjectMetricSource object = 2;

  // pods refers to a metric describing each pod in the current scale target
  // (for example, transactions-processed-per-second).  The values will be

Instructions for reporting a vulnerability can be found on the
[Istio Security Vulnerabilities] page. The Istio Product Security Working Group receives
vulnerability and security issue reports, and the company affiliation of the members of
the group can be found at [Early Disclosure Membership].

## Security Bulletins

Information about previous Istio vulnerabilities can be found on the
[Security Bulletins] page.

    - jsonPath: .spec.ipAddressPools
      name: IPAddressPools
      type: string
    - jsonPath: .spec.ipAddressPoolSelectors
      name: IPAddressPool Selectors
      type: string
    - jsonPath: .spec.peers
      name: Peers
      type: string
    - jsonPath: .spec.nodeSelectors
      name: Node Selectors
      priority: 10
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:

// CSIDriver objects are non-namespaced.
message CSIDriver {
  // Standard object metadata.
  // metadata.Name indicates the name of the CSI driver that this object
  // refers to; it MUST be the same name returned by the CSI GetPluginName()
  // call for that driver.
  // The driver name must be 63 characters or less, beginning and ending with

  // If not specified, it defaults to NotRequired.
  optional string restartPolicy = 2;
}

// ContainerState holds a possible state of container.
// Only one of its members may be specified.
// If none of them is specified, the default one is ContainerStateWaiting.
message ContainerState {
  // Details about a waiting container
  // +optional
  optional ContainerStateWaiting waiting = 1;

  // be one of the following values:
  // * Exact: Matches the URL path exactly.
  // * Prefix: Matches based on a URL path prefix split by '/'. Matching is
  //   done on a path element by element basis. A path element refers is the
  //   list of labels in the path split by the '/' separator. A request is a
  //   match for path p if every p is an element-wise prefix of p of the

  // be one of the following values:
  // * Exact: Matches the URL path exactly.
  // * Prefix: Matches based on a URL path prefix split by '/'. Matching is
  //   done on a path element by element basis. A path element refers is the
  //   list of labels in the path split by the '/' separator. A request is a
  //   match for path p if every p is an element-wise prefix of p of the

* Cases for other API changes require TOC approval
    * Simple `meshConfig` changes have been approved in the past. Functionality should not be enabled by default.
* For large API changes, 2 members of the TOC must approve the PR before release manager approval in the release branch
  of the istio/api repository. This does not have to wait for the weekly TOC meeting.
    * Risk should be assessed in the PR.

	mt.Assert(ztunnelConnected.Name(), nil, monitortest.Exactly(1))

	// we should get the fd to dev null. note that we can't assert the fd number
	// as the kernel may have given us a different number that refers to the same file.
	assert.Equal(t, len(fds), 1)
	// in theory we should close the fd, but it's just a test..

	assert.Equal(t, m.Payload.(*zdsapi.WorkloadRequest_Add).Add.Uid, uid)