//  "data encipherment",
  //  "cert sign",
  //  "crl sign",
  //  "encipher only",
  //  "decipher only",
  //  "any",
  //  "server auth",
  //  "client auth",
  //  "code signing",
  //  "email protection",
  //  "s/mime",
  //  "ipsec end system",
  //  "ipsec tunnel",
  //  "ipsec user",
  //  "timestamping",
  //  "ocsp signing",
  //  "microsoft sgc",
  //  "netscape sgc"

    rollingMaxSurge: 100%
    rollingMaxUnavailable: 25%

    hub: ""
    tag: ""
    variant: ""

    # Can be a full hub/image:tag
    image: pilot
    traceSampling: 1.0

    # Resources for a small pilot install
    resources:
      requests:
        cpu: 500m
        memory: 2048Mi

    # Set to `type: RuntimeDefault` to use the default profile if available.
    seccompProfile: {}

  // The token will only be valid for as long as the bound object exists.
  // NOTE: The API server's TokenReview endpoint will validate the
  // BoundObjectRef, but other audiences may not. Keep ExpirationSeconds
  // small if you want prompt revocation.
  // +optional
  optional BoundObjectReference boundObjectRef = 3;
}

// TokenRequestStatus is the result of a token request.
message TokenRequestStatus {

  //  "key encipherment", "key agreement", "data encipherment",
  //  "cert sign", "crl sign", "encipher only", "decipher only", "any",
  //  "server auth", "client auth",
  //  "code signing", "email protection", "s/mime",
  //  "ipsec end system", "ipsec tunnel", "ipsec user",
  //  "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"
  // +listType=atomic
  repeated string usages = 5;

    rollingMaxSurge: 100%
    rollingMaxUnavailable: 25%
    hub: ""
    tag: ""
    variant: ""
    # Can be a full hub/image:tag
    image: pilot
    traceSampling: 1.0
    # Resources for a small pilot install
    resources:
      requests:
        cpu: 500m
        memory: 2048Mi
    # Set to `type: RuntimeDefault` to use the default profile if available.
    seccompProfile: {}

  // shufflesharding and thus makes the distinguisher method of
  // associated flow schemas irrelevant.  This field has a default
  // value of 64.
  // +optional
  optional int32 queues = 1;

  // `handSize` is a small positive number that configures the
  // shuffle sharding of requests into queues.  When enqueuing a request
  // at this priority level the request's flow identifier (a string

  // shufflesharding and thus makes the distinguisher method of
  // associated flow schemas irrelevant.  This field has a default
  // value of 64.
  // +optional
  optional int32 queues = 1;

  // `handSize` is a small positive number that configures the
  // shuffle sharding of requests into queues.  When enqueuing a request
  // at this priority level the request's flow identifier (a string

	_                                = compiledInCharts
	// Live charts come from manifests/
	liveCharts = chartSourceType(filepath.Join(env.IstioSrc, operatorSubdirFilePath))
)

type testGroup []struct {
	desc string
	// Small changes to the input profile produce large changes to the golden output
	// files. This makes it difficult to spot meaningful changes in pull requests.
	// By default we hide these changes to make developers life's a bit easier. However,

// Copyright © 2021 NAME HERE <EMAIL ADDRESS>
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,

  // shufflesharding and thus makes the distinguisher method of
  // associated flow schemas irrelevant.  This field has a default
  // value of 64.
  // +optional
  optional int32 queues = 1;

  // `handSize` is a small positive number that configures the
  // shuffle sharding of requests into queues.  When enqueuing a request
  // at this priority level the request's flow identifier (a string