//
// +k8s:deepcopy-gen=true
// +protobuf=true
// +k8s:openapi-gen=true
message RawExtension {
  // Raw is the underlying serialization of this object.
  //
  // TODO: Determine how to detect ContentType and ContentEncoding of 'Raw' data.
  optional bytes raw = 1;
}

// TypeMeta is shared by all top level objects. The proper way to use it is to inline it in your type,
// like this:
//

                  }
                ],
                "transport_socket": {
                  "name": "raw_buffer",
                  "typed_config": {
                    "@type": "type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer"
                  }
                }
              }
            },
            "metadata": {
              "filter_metadata": {

                  }
                ],
                "transport_socket": {
                  "name": "raw_buffer",
                  "typed_config": {
                    "@type": "type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer"
                  }
                }
              }
            },
            "metadata": {

- CAP_SYS_ADMIN
- CAP_NET_ADMIN
- CAP_NET_RAW

## Ambient mode details

Fundamentally, this component is responsible for the following:

  // +optional
  optional int32 targetAverageUtilization = 2;

  // targetAverageValue is the target value of the average of the
  // resource metric across all relevant pods, as a raw value (instead of as
  // a percentage of the request), similar to the "pods" metric source type.
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity targetAverageValue = 3;

-A ISTIO_OUTPUT -j ISTIO_REDIRECT
-A OUTPUT -p udp --dport 53 -m owner --uid-owner 1337 -j RETURN
-A OUTPUT -p udp --dport 53 -m owner --gid-owner 1337 -j RETURN
-A OUTPUT -p udp --dport 53 -j REDIRECT --to-port 15053
COMMIT
* raw
-A OUTPUT -p udp --dport 53 -m owner --uid-owner 1337 -j CT --zone 1
-A OUTPUT -p udp --sport 15053 -m owner --uid-owner 1337 -j CT --zone 2
-A OUTPUT -p udp --dport 53 -m owner --gid-owner 1337 -j CT --zone 1

                "match": {},
                "transport_socket": {
                  "name": "envoy.transport_sockets.raw_buffer",
                  "typed_config": {
                    "@type": "type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer"
                  }
                }
              }
            ]
          }
        }
      ]
    },

# Downloaded from https://github.com/metallb/metallb/raw/v0.13.12/config/manifests/metallb-native.yaml
# With quay.io hub replaced with gcr.io/istio-testing
# And probes tuned to startup faster
apiVersion: v1
kind: Namespace
metadata:
  labels:
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/warn: privileged
  name: metallb-system
---
apiVersion: apiextensions.k8s.io/v1

      privileged: {{ .Values.global.proxy.privileged }}
      capabilities:
    {{- if not (or .Values.pilot.cni.enabled .Values.istio_cni.enabled) }}
        add:
        - NET_ADMIN
        - NET_RAW
    {{- end }}
        drop:
        - ALL
    {{- if not (or .Values.pilot.cni.enabled .Values.istio_cni.enabled) }}
      readOnlyRootFilesystem: false
      runAsGroup: 0
      runAsNonRoot: false

      privileged: {{ .Values.global.proxy.privileged }}
      capabilities:
    {{- if not (or .Values.pilot.cni.enabled .Values.istio_cni.enabled) }}
        add:
        - NET_ADMIN
        - NET_RAW
    {{- end }}
        drop:
        - ALL
    {{- if not (or .Values.pilot.cni.enabled .Values.istio_cni.enabled) }}
      readOnlyRootFilesystem: false
      runAsGroup: 0
      runAsNonRoot: false