// +optional
  optional k8s.io.api.authentication.v1.UserInfo userInfo = 1;
}

// TokenReview attempts to authenticate a token to a known user.
// Note: TokenReview requests may be cached by the webhook token authenticator
// plugin in the kube-apiserver.
message TokenReview {
  // Standard object's metadata.

                            of the authorized client certificates.
                          items:
                            type: string
                          type: array
                        verifyCertificateSpki:
                          description: An optional list of base64-encoded SHA-256
                            hashes of the SPKIs of authorized client certificates.

  // If set to false, pod information will not be passed on mount.
  // Default is false.
  //
  // The CSI driver specifies podInfoOnMount as part of driver deployment.
  // If true, Kubelet will pass pod information as VolumeContext in the CSI NodePublishVolume() calls.
  // The CSI driver is responsible for parsing and validating the information passed in as VolumeContext.
  //

	}

	p.addToCacheUnderLock(uid, workload)
	return workload.Netns
}

// Update the cache with the given uid and nspath. Return the Netns for the given uid.
// If uid is already present, a cached Netns is returned, and the given nspath is ignored.
func (p *podNetnsCache) Get(uid string) Netns {
	// lock current snapshot pod map
	p.mu.RLock()
	defer p.mu.RUnlock()
	if info, f := p.currentPodCache[uid]; f {

ringHash - required: - maglev properties: httpCookie: description: Hash based on HTTP cookie. properties: name: description: Name of the cookie. type: string path: description: Path to set for the cookie. type: string ttl: description: Lifetime of the cookie. type: string required: - name type: object httpHeaderName: description: Hash based on a specific HTTP header. type: string httpQueryParameterNa: description: Hash based on a specific HTTP query parameter. type: string maglev: description: The...

                            of the authorized client certificates.
                          items:
                            type: string
                          type: array
                        verifyCertificateSpki:
                          description: An optional list of base64-encoded SHA-256
                            hashes of the SPKIs of authorized client certificates.

As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
When configuring the chart, you should not include this.

	"istio.io/istio/pkg/config/host"
)

// ClusterFilter is used to pass filter information into cluster based config writer print functions
type ClusterFilter struct {
	FQDN      host.Name
	Port      int
	Subset    string
	Direction model.TrafficDirection
}

// Verify returns true if the passed cluster matches the filter fields
func (c *ClusterFilter) Verify(cluster *cluster.Cluster) bool {
	name := cluster.Name

  // `kind` indicates which one of the other fields is non-empty.
  // Required
  // +unionDiscriminator
  optional string kind = 1;

  // `user` matches based on username.
  // +optional
  optional UserSubject user = 2;

  // `group` matches based on user group name.
  // +optional
  optional GroupSubject group = 3;

  // `serviceAccount` matches ServiceAccounts.
  // +optional

  // `kind` indicates which one of the other fields is non-empty.
  // Required
  // +unionDiscriminator
  optional string kind = 1;

  // `user` matches based on username.
  // +optional
  optional UserSubject user = 2;

  // `group` matches based on user group name.
  // +optional
  optional GroupSubject group = 3;

  // `serviceAccount` matches ServiceAccounts.
  // +optional