contact_links:
- name: "Crash bug"
  url: https://istio.io/about/security-vulnerabilities/

  // Minimum consecutive successes for the probe to be considered successful after having failed.
  // Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
  // +optional
  optional int32 successThreshold = 5;

  // Minimum consecutive failures for the probe to be considered failed after having succeeded.
  // Defaults to 3. Minimum value is 1.
  // +optional

      and apparatus claims, in any patent Licensable by such Contributor that
      would be infringed, but for the grant of the License, by the making,
      using, selling, offering for sale, having made, import, or transfer of
      either its Contributions or its Contributor Version.

1.12. “Secondary License”

      means either the GNU General Public License, Version 2.0, the GNU Lesser

			panic("bad key:value in " + s)
		}
		out[strings.TrimSpace(kv[0])] = strings.TrimSpace(kv[1])
	}
	if len(out) == 0 {
		return nil
	}
	return out
}

// endpointSubsetAddressVal returns a map having subset address type for an endpoint.
func endpointSubsetAddressVal(hostname, ip, nodeName string) map[string]any {
	out := make(map[string]any)
	if hostname != "" {
		out["hostname"] = hostname
	}
	if ip != "" {

      #   values: S1,S2
      #   topologyKey: "kubernetes.io/hostname"
      # This pod anti-affinity rule says that the pod requires not to be scheduled
      # onto a node if that node is already running a pod with label having key
      # "security" and value "S1".
      podAntiAffinityLabelSelector: []
      podAntiAffinityTermLabelSelector: []

      # whether to run the gateway in a privileged container
      runAsRoot: false

      #   values: S1,S2
      #   topologyKey: "kubernetes.io/hostname"
      # This pod anti-affinity rule says that the pod requires not to be scheduled
      # onto a node if that node is already running a pod with label having key
      # "security" and value "S1".
      podAntiAffinityLabelSelector: []
      podAntiAffinityTermLabelSelector: []

      # whether to run the gateway in a privileged container
      runAsRoot: false

  // pods of a disrupted application might not get a chance to become healthy.
  // Healthy pods will be subject to the PDB for eviction.
  //
  // Additional policies may be added in the future.
  // Clients making eviction decisions should disallow eviction of unhealthy pods
  // if they encounter an unrecognized policy in this field.
  //
  // This field is beta-level. The eviction API uses this field when

  // +listType=set
  // Required.
  repeated string nonResourceURLs = 6;
}

// PolicyRulesWithSubjects prescribes a test that applies to a request to an apiserver. The test considers the subject
// making the request, the verb being requested, and the resource to be acted upon. This PolicyRulesWithSubjects matches
// a request if and only if both (a) at least one member of subjects matches the request and (b) at least one member

  // +listType=set
  // Required.
  repeated string nonResourceURLs = 6;
}

// PolicyRulesWithSubjects prescribes a test that applies to a request to an apiserver. The test considers the subject
// making the request, the verb being requested, and the resource to be acted upon. This PolicyRulesWithSubjects matches
// a request if and only if both (a) at least one member of subjects matches the request and (b) at least one member

- [ ] Security
- [ ] Test and Release
- [ ] User Experience
- [ ] Developer Infrastructure

**Please check any characteristics that apply to this pull request.**