"istiocoredns.enabled" "the in-proxy DNS capturing (ISTIO_META_DNS_CAPTURE)"
}}
{{- range $dep, $replace := $deps }}
{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(")  ".Values." (replace "." ")." $dep) ")}}") $}}
{{- if not (eq $res "")}}

  // +optional
  optional string verb = 2;
}

// NonResourceRule holds information that describes a rule for the non-resource
message NonResourceRule {
  // Verb is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options.  "*" means all.
  repeated string verbs = 1;

  // NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full,

## Reference

```

### New API customization

The [new platform level installation API](https://github.com/istio/api/blob/master/operator/v1alpha1/operator.proto)
defines install time parameters like component and enablement and namespace, and K8s settings like resources, HPA spec etc. in a structured way.
The simplest customization is to turn components on and off. For example, to turn on cni ([samples/cni-on.yaml](samples/cni-on.yaml):

```yaml

  // +optional
  optional string verb = 2;
}

// NonResourceRule holds information that describes a rule for the non-resource
message NonResourceRule {
  // Verb is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options.  "*" means all.
  repeated string verbs = 1;

  // NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full,

This includes things like its IP address, identity, metadata (name, namespace, app, version, etc), and whether it has a waypoint proxy associated.

The `Service` aims to represent everything about a service (generally a `Service` or `ServiceEntry`).
This includes things like its IP addresses, ports and an associated waypoint proxy if it has one.

### Authorization Type

  // is considered to match if either object matches the selector. A null
  // object (oldObject in the case of create, or newObject in the case of
  // delete) or an object that cannot have labels (like a
  // DeploymentRollback or a PodProxyOptions object) is not considered to
  // match.
  // Use the object selector only if the webhook is opt-in, because end
  // users may skip the admission webhook by setting the labels.

### Examples

#### Configuring mesh configuration settings

Any [Mesh Config](https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/) options can be configured like below:

```yaml
meshConfig:
  accessLogFile: /dev/stdout
```

#### Revisions

Control plane revisions allow deploying multiple versions of the control plane in the same cluster.

// 		MyPlugin runtime.RawExtension `json:"myPlugin"`
// 	}
//
// 	type PluginA struct {
// 		AOption string `json:"aOption"`
// 	}
//
// // On the wire, the JSON will look something like this:
//
// 	{
// 		"kind":"MyAPIObject",
// 		"apiVersion":"v1",
// 		"myPlugin": {
// 			"kind":"PluginA",
// 			"aOption":"foo",
// 		},
// 	}
//

endif
# The old docker issue manifests as not being able to run *any* binary. So we can test
# by trying to run a trivial program and ensuring it actually ran. If not, emit our warning.
# Note: we cannot do anything like $(shell docker version) to check, since that would also fail.
CAN_RUN := $(shell echo "can I run echo")
ifeq ($(CAN_RUN),)
$(error $(warning))
endif