Copyright (c) 2016 Mail.Ru Group

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

  // The token will only be valid for as long as the bound object exists.
  // NOTE: The API server's TokenReview endpoint will validate the
  // BoundObjectRef, but other audiences may not. Keep ExpirationSeconds
  // small if you want prompt revocation.
  // +optional
  optional BoundObjectReference boundObjectRef = 3;
}

// TokenRequestStatus is the result of a token request.
message TokenRequestStatus {

Copyright © 2012 Greg Jones (greg.jones@gmail.com)

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

Copyright 2013 ChaiShushan <chaishushan{AT}gmail.com>. All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:

   * Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
   * Redistributions in binary form must reproduce the above

FROM ubuntu:jammy

ENV DEBIAN_FRONTEND=noninteractive

# Do not add more stuff to this list that isn't small or critically useful.
# If you occasionally need something on the container do
# sudo apt-get update && apt-get whichever

# hadolint ignore=DL3005,DL3008
RUN apt-get update && \
  apt-get install --no-install-recommends -y \
  ca-certificates \
  curl \
  iptables \
  iproute2 \
  iputils-ping \
  knot-dnsutils \
  netcat \

  // shufflesharding and thus makes the distinguisher method of
  // associated flow schemas irrelevant.  This field has a default
  // value of 64.
  // +optional
  optional int32 queues = 1;

  // `handSize` is a small positive number that configures the
  // shuffle sharding of requests into queues.  When enqueuing a request
  // at this priority level the request's flow identifier (a string

  // shufflesharding and thus makes the distinguisher method of
  // associated flow schemas irrelevant.  This field has a default
  // value of 64.
  // +optional
  optional int32 queues = 1;

  // `handSize` is a small positive number that configures the
  // shuffle sharding of requests into queues.  When enqueuing a request
  // at this priority level the request's flow identifier (a string

  //  "data encipherment",
  //  "cert sign",
  //  "crl sign",
  //  "encipher only",
  //  "decipher only",
  //  "any",
  //  "server auth",
  //  "client auth",
  //  "code signing",
  //  "email protection",
  //  "s/mime",
  //  "ipsec end system",
  //  "ipsec tunnel",
  //  "ipsec user",
  //  "timestamping",
  //  "ocsp signing",
  //  "microsoft sgc",
  //  "netscape sgc"

  * This puts a much tighter budget on CPU, memory, latency, and throughput requirements than traditional Istio sidecars.

Ztunnel was not designed to be a feature-rich data plane.
Quite the opposite - an *aggressively* small feature set is the key feature that makes ztunnel viable.
It very intentionally does not offer L7 (HTTP) functionality, for instance, which would likely violate some of the goals above, without contributing to them.

* For manual cherry-picks:
    * Large fixes, where the LOC>100 not withstanding unit tests changes, require subject-matter expert approval.